Banned AI chat-stealing extension returns to Chrome Store

Browser extension marketplaces have historically struggled with 'zombie' malware patterns, where removed extensions reappear under slightly modified names or developer accounts. This cat-and-mouse dynamic predates AI-specific threats but has intensified as extensions increasingly request broad permissions to interact with web content. The standard vetting model combines automated static analysis with periodic manual review, creating windows of opportunity for actors who adapt code faster than signatures update. Prior precedents show that high ratings and install counts often persist across takedown-reupload cycles because user reviews are not always purged alongside malicious versions. Platform operators typically rely on reactive reporting rather than continuous behavioral monitoring, making reinstatement a common vector for recidivism. This pattern reflects a structural tension between open marketplace accessibility and rigorous security enforcement, particularly for extensions targeting rapidly evolving web technologies like LLM interfaces where legitimate functionality and data exfiltration can appear structurally identical to automated scanners.

On August 11, 2026, SecurityWeek reported that a browser extension previously banned from the Chrome Web Store for stealing AI chat data had been reinstated and resumed malicious activities. According to the report, the extension had originally amassed over 300,000 installs and maintained a 4.6-star rating before Google removed it for policy violations involving unauthorized data collection. Despite this prior enforcement action, the extension reappeared in the store and, according to SecurityWeek, immediately recommenced the exfiltration of user interactions with AI interfaces.

The report was amplified on social media by security researcher Shah Sheikh, who shared the SecurityWeek article to warn followers about the extension's return and the ongoing privacy risks it posed. Sheikh’s post highlighted the specific metrics of the extension’s previous success—300,000 installs and a high user rating—to underscore how easily malicious tools can maintain credibility within official marketplaces even after being flagged for abuse. The timeline indicates that both the initial reporting and the subsequent amplification occurred on the same day, suggesting a rapid response cycle between security journalism and community alert systems.

Google, as the platform operator, is identified as the defending party in this controversy due to its role in vetting and hosting the extension. While Google previously enforced its policies by removing the extension for data theft, the reinstatement suggests either a failure in automated detection mechanisms or an insufficient review process during the resubmission phase. SecurityWeek alleges that the returned extension is functionally identical or sufficiently similar to the banned version to constitute a recurrence of the same malicious behavior. This implies that the developer was able to circumvent existing safeguards, potentially through code obfuscation, repackaging under new metadata, or exploiting gaps in post-removal monitoring.

The core allegation is that the extension targets AI chat interfaces specifically, harvesting prompts and responses that users believe are private or ephemeral. According to SecurityWeek, this data theft resumed immediately upon reinstatement, indicating pre-existing malicious intent rather than accidental policy non-compliance. The incident raises questions about the efficacy of current marketplace vetting when adversaries are motivated to target emerging AI workflows. Critics argue that the high install count and positive rating demonstrate how social proof can be weaponized to mask supply chain attacks, while defenders might point to the sheer volume of extensions reviewed daily as a structural constraint.

No statement from Google regarding this specific reinstatement is present in the provided sources. Consequently, the narrative relies entirely on SecurityWeek’s technical analysis and Shah Sheikh’s dissemination of those findings. The sequence of events—from ban to reinstatement to renewed malicious activity—is presented by critics as evidence of systemic vulnerability in the Chrome Web Store’s enforcement lifecycle. The focus remains on the gap between removal and prevention, where a known bad actor or artifact was permitted to re-enter the ecosystem despite a documented history of policy violations.

Over 300,000 users who installed the extension face potential exposure of sensitive AI chat prompts and responses. The primary harm is privacy violation through unauthorized data exfiltration from LLM interfaces. Users trusting the 4.6-star rating may have unknowingly granted persistent access to confidential conversations. The magnitude is significant for individual privacy but limited in broader platform impact compared to systemic breaches. Secondary stakeholders include enterprise users deploying AI tools via browser extensions, who now face increased compliance and data governance risks.