The January 2026 Incident
Updated for 2026. In January 2026, two malicious Chrome add-ons were found with 900,000+ users.
Their names looked like real AI tools:
- "Chat GPT for Chrome with GPT-5, Claude Sonnet and DeepSeek AI" — 600,000+ users
- "AI Sidebar with Deepseek, ChatGPT, Claude and more" — 300,000+ users
Both did the same thing. Every 30 minutes, they sent full AI chats to a remote server. The stolen data included code, personal details, legal notes, and business plans. Astrix Security confirmed this.
These add-ons asked to "collect anonymous, non-identifiable analytics data." That wording sounds safe. It was not. The data collected was fully identifiable and highly sensitive.
The Security Inversion Problem
Users who install AI privacy tools want protection. The January 2026 case shows the worst-case result: the tool you installed for privacy is the one stealing your data.
This is not a theory. It happened to 900,000 users at once. Chrome Web Store scanning did not detect it. User reviews did not reveal it. The theft was hidden as "analytics."
Incogni found that 67% of AI Chrome add-ons actively collect user data. For IT teams, the key question is not "does this collect any data?" It is: "can I verify this add-on cannot send conversation content to a third party?"
The Architecture Verification Test
There is one reliable check for local processing: network monitoring.
An add-on that detects PII locally produces zero outbound traffic during detection. No connection to any external server should appear between a user's paste and the AI platform submission. Only the processed prompt goes out.
An add-on that routes traffic through a proxy sends your content to a third-party server. That server operator is now inside your threat model.
The IT verification steps are simple:
- Deploy the add-on in a monitored network
- Run test prompts
- Check for outbound connections to the publisher's servers during PII processing
If it fails this test, do not approve it. Marketing claims do not matter. Network traffic is the proof.
Local processing is trustworthy because it is verifiable. You do not need to trust the publisher. You can observe the behavior directly. See how anonym.legal handles this in our Chrome extension security overview and compliance guide.
What IT Teams Should Require
After January 2026, the bar for AI browser tools must be higher.
The minimum list:
- Local processing — verified by network audit, not just claimed
- Known publisher — real company, clear business model
- Independent certification — ISO 27001 or equivalent
- No developer-server routing for core privacy features
Most AI browser add-ons will not pass this list. The 67% collection rate makes that clear. High install counts are not a safety signal. The January 2026 tools had hundreds of thousands of users before anyone checked.
For more on safe AI browser tools, see our security and compliance page.