Your ChatGPT Chrome Extension Might Be Spying on You — Here's What Developers Should Use Instead — HeaderSnap ModHeader was removed from Chrome & Edge over a hidden data collector — what happened and what to do
HeaderSnap
← All posts
March 24, 2026

Your ChatGPT Chrome Extension Might Be Spying on You — Here’s What Developers Should Use Instead

On March 19, 2026, researchers confirmed that two Chrome extensions had been quietly harvesting conversations from 900,000+ users’ ChatGPT, Claude, and DeepSeek sessions.

Both extensions carried Google’s Chrome “Featured” badge — the indicator supposed to mean the extension is “high-quality, secure, and safe.” Neither was.

If you’ve installed a Chrome extension to assist with AI workflows in the past year, you should stop and read this.

What Happened

Two extensions were identified harvesting AI conversations at scale:

“Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI” — 600,000+ users. Still active as of the report. The extension operated in passive monitoring mode: no visible changes to your browser, no performance degradation, nothing to trigger suspicion. It silently collected your AI chat sessions and staged them for exfiltration.

“AI Sidebar with Deepseek, ChatGPT, Claude and more” — 300,000+ users. Same attack pattern. Same targets. Same approach of blending in.

Together: 900,000 developers, researchers, and teams whose conversations with AI assistants were harvested without their knowledge.

The conversations being collected weren’t casual. Developers use ChatGPT and Claude to write code, debug production issues, and reason through architecture decisions. Those conversations contain function signatures, database schemas, business logic, API keys pasted for context, and proprietary system prompts. All of it was flowing somewhere it shouldn’t.

Both extensions displayed Google’s Chrome Web Store “Featured” badge. This is important to understand, because that badge is how most users assess trust.

Google’s own description of the Featured badge: extensions that are “high quality, follow our best practices, and that provide a great user experience.”

What the badge does not verify: whether the extension is exfiltrating your data.

The verification process evaluates the extension against a checklist. It does not involve ongoing behavioral auditing. Once featured, an extension can push updates — and those updates are not individually reviewed before distribution. Your browser auto-updates the extension silently. What you installed last month may not be what’s running today.

This isn’t a new problem. In February 2026, QuickLens — a popular header editing extension — was caught stripping security headers after an ownership transfer. Before that, ShotBird was sold to a new owner and within days began behaving as malware — silently, through an automatic browser update. Earlier this year, a cookie harvesting campaign affected 37.4 million users across dozens of extensions.

The total user impact from extension malware this quarter alone is over 40 million people.

Why AI Extensions Are Especially Risky

A malicious tab capture extension is bad. A malicious AI workflow extension is worse.

The attack surface is different. When you interact with ChatGPT or Claude through the browser, you’re often in a context you think is private — working through a sensitive technical problem, prototyping an internal tool, explaining a production incident with full context. You’re not thinking about who else might be watching that conversation.

Fake AI extensions target exactly this context. They embed themselves in your workflow, gain permissions to read page content, and wait. No action required on your part. No error. No warning. Just your conversations going somewhere you didn’t intend.

The specific risk for developers:

  • System prompts containing proprietary business logic
  • API keys pasted as context to get debugging help
  • Code snippets that reveal internal architecture
  • Database schema discussed while designing queries
  • Security configurations reviewed during audits

This is the data attackers want. These extensions are positioned exactly where that data flows.

How to Verify You’re Not Affected

Immediate steps:

  1. Go to chrome://extensions/ and audit every installed extension
  2. Remove any AI assistant extension you did not personally vet
  3. Check the specific extension names above — if installed, remove immediately
  4. Review what permissions each extension has. “Read and change all your data on all websites” is a high-risk permission

How to evaluate an extension before installing:

  • Check the permissions manifest. An extension’s permissions list is visible in chrome://extensions under Details. This tells you what the browser actually allows the extension to access — not what it promises to do.
  • Understand API differences. Extensions using the webRequest API can intercept, read, and modify your network traffic in JavaScript. Extensions using declarativeNetRequest cannot — they declare rules that Chrome enforces directly, with the extension code never touching the underlying request data. This is a structural difference, not a policy one.
  • Check the developer. Is this an individual developer or a corporate entity? Has ownership recently changed?
  • Check update history. Sudden behavioral changes in extension updates are a red flag
  • Check permissions against the stated purpose. A tool that claims to “enhance” ChatGPT needs page access by design — which is exactly why fake AI extensions are so dangerous. A legitimate developer tool for HTTP header editing has no business reason to request that permission.

The Deeper Problem: Architecture Determines What’s Possible

Google’s verification is a snapshot. What an extension does after that snapshot — after the featured badge is awarded, after your browser installs the update — is not continuously monitored.

The question is not whether an extension promises to protect your data. The question is whether it is architecturally capable of misusing it.

This is where Chrome’s extension API model matters. Extensions built on the webRequest API can intercept request data as it flows through the browser. That capability exists in the extension runtime, and a malicious update can begin exploiting it without any visible change from the user’s perspective.

Extensions using declarativeNetRequest work differently. They operate by declaring filter rules that Chrome enforces at the browser level. The extension code itself never receives request content to inspect or forward. The architectural path for data exfiltration through the network request pipeline simply doesn’t exist.

You can verify which model an extension uses. Open chrome://extensions, click Details, and review the listed permissions. Look for declarativeNetRequest versus webRequest. This won’t tell you everything — but it tells you what the browser structurally guarantees, not just what the developer promises.

What API Developers Should Use Instead

If your use case is HTTP header editing — modifying request headers, setting authorization tokens, testing API behavior — there’s a cleaner path that doesn’t involve trusting an extension with access to your AI conversations.

Use a tool where the architecture rules out the risk.

HeaderSnap is an HTTP header editor for Chrome built exclusively on the declarativeNetRequest API. The extension code has no mechanism to intercept or forward request data — Chrome enforces the rules HeaderSnap declares at the browser level, not through the extension runtime.

What it does:

  • Add, modify, and remove HTTP request and response headers
  • URL pattern matching (glob or regex) with live preview
  • Profile system for dev/staging/production environments
  • ModHeader v2 import compatibility
  • URL pattern tester

What it doesn’t do:

  • Intercept request data
  • Contact external servers
  • Collect usage analytics
  • Operate any cloud backend

These aren’t promises. They’re consequences of how the extension is built. You can verify this yourself: install HeaderSnap, open chrome://extensions, click Details, and review the permissions listed. Then, if you want to go further, open Chrome DevTools → Network tab → filter by XHR and Fetch — you won’t see any outbound requests from HeaderSnap, because the declarativeNetRequest architecture has no mechanism to make them.

Free, no ads, no account required. Available at headersnap.com.

The Pattern Is Clear

The extensions that harvested 900,000 AI conversations this week were not anomalies. They were the latest iteration of an attack pattern that has compromised tens of millions of users in 2026 alone.

The pattern works because users extend trust based on badges and download counts — social proof signals that have been successfully gamed. The extensions look legitimate. They show up in search results. They have ratings. They have Google’s Featured badge.

Architectural transparency is harder to fake. An extension either uses declarativeNetRequest or it doesn’t. It either makes external network calls or it doesn’t. These are technical properties you can verify, not marketing claims you have to take on faith.

If you rely on any extension in the same browser context as your AI workflow, it’s worth asking: what does this extension’s architecture prevent it from doing, not just what does it promise not to do?

HeaderSnap is a privacy-first HTTP header editor for API developers. Get it at headersnap.com.