Skip to content
ThreatCluster

Chrome Extension Steals AI Prompts from 100k Users Across Multiple Platforms

First seen 28 Jul 2026, 21:24 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •July 29, 2026 at 17:47 UTC
  • •The 'SecondBrain' extension collects prompts and responses from users without interaction.
  • •It has around 100,000 users and operates across nine major AI platforms.
  • •Despite claiming no data collection, the extension actively transmits sensitive user data.

A Chrome extension named 'Prompt Optimizer - SecondBrain' has been found to collect user prompts and AI responses without user interaction. The extension, which has approximately 100,000 installations, operates silently on nine AI platforms, including ChatGPT and Claude. It captures data by running a capture engine at document_start and sending POST requests to a vendor endpoint. Despite claiming no data collection in its privacy declaration, the extension has been confirmed to store user credentials and transmit sensitive information. Users are at risk of their AI interactions being harvested without consent. The extension's malicious behavior was reproduced on a clean profile without any direct user engagement. Security researchers are currently investigating the implications of this extension.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 54d ago How this analysis works

Timeline

2026-07-28
Discovery of data harvesting behavior
Researchers confirmed that the 'SecondBrain' extension collects user prompts and responses without user interaction.
Cybersecuritynews
2026-07-28
User reports of unauthorized data collection
Users reported that the extension harvested data despite its claims of not collecting personal information.
Reddit

More articles in this cluster (2)

Extracted Entities (7)

1 / 3