Malicious Chrome Extension 'Prompt Optimizer' Secretly Harvests AI Conversations
A popular Chrome extension with 100,000 installs, 'Prompt Optimizer – SecondBrain,' is covertly exfiltrating user conversations from major AI platforms like ChatGPT, Claude, and Gemini, despite privacy claims.
A seemingly innocuous Chrome extension, 'Prompt Optimizer – SecondBrain' (ID: aajjgdpofhhcjmjoombjdfepplndhgcp), has been discovered to be secretly harvesting user conversations across nine major artificial intelligence platforms. Despite its official listing and privacy policy stating no personal data collection, the extension, with approximately 100,000 installs, actively captures interactions with services including ChatGPT, Claude, Gemini, Grok, Meta AI, DeepSeek, Perplexity, and both consumer and enterprise versions of Microsoft Copilot.
The extension operates with a disturbing level of stealth, requiring no user interaction beyond installation. Upon loading, its background worker automatically overrides internal settings to enable data collection, regardless of user preferences. A background listener on tabs.onUpdated triggers the extension to fetch remote configuration files every minute, dictating its capture rules. This mechanism ensures that the extension is always ready to intercept data from any webpage visited.
The core data capture functionality is embedded within a file misleadingly named 'chatgpt_context_fetch_diagnostics.js.' This script overrides critical browser networking functions such as window.fetch, XMLHttpRequest.open, XMLHttpRequest.send, and the WebSocket constructor. This allows the extension to intercept traffic before it even reaches the AI service. For platforms where network hooks are insufficient, the extension employs three separate MutationObservers to scrape AI responses directly from rendered web pages. Additionally, keyloggers are utilized to capture user inputs on platforms like Meta AI before messages are submitted.
Of particular concern is the extension's specific targeting of Microsoft 365 Copilot. It parses SignalR protocol frames to extract prompts and bot responses, posing a significant risk of corporate data leakage. Organizations utilizing this extension could inadvertently expose internal communications outside their secure boundaries. This vector highlights broader concerns about AI prompt vulnerabilities within enterprise environments.
Captured data is batched, compressed, and encrypted using AES-GCM before being transmitted to the domain ingest.secondbrain.is/context. However, the encryption key is provided by SecondBrain's servers, not generated locally, enabling the provider to decrypt all uploaded conversation data. This was verified by researchers who decrypted captured traffic and matched authentication tags, confirming the exfiltration of sensitive user interactions.
The discrepancy between the extension's stated privacy policy and its actual behavior is stark. While the Chrome Web Store listing claims zero data collection, the extension offers no functional way to disable its background harvesting. The only visible toggle controls a cosmetic floating UI button, while older consent screens remain dormant in the codebase, indicating a deliberate design to deceive users.
Security teams and individual users are urged to take immediate action. This includes enforcing extension blocklists for the specific extension ID (aajjgdpofhhcjmjoombjdfepplndhgcp) via Google Chrome and Microsoft Edge policies. Furthermore, monitoring network logs for outbound connections to ingest.secondbrain.is and optimize.secondbrain.is is crucial. Organizations using Microsoft 365 Copilot must treat this extension as an active data exfiltration threat, necessitating a review of installed browser extensions and user awareness training.
This incident underscores the growing threat posed by malicious browser extensions, particularly those that leverage AI platforms. As AI tools become more integrated into daily workflows, the potential for these extensions to act as data exfiltration vectors increases, demanding heightened vigilance from both users and security professionals.