The January 2026 Incident
Updated for 2026. In January 2026, two malicious Chrome add-ons were found with 900,000+ users.
Their names looked like real AI tools:
- "Chat GPT for Chrome with GPT-5, Claude Sonnet and DeepSeek AI" — 600,000+ users
- "AI Sidebar with Deepseek, ChatGPT, Claude and more" — 300,000+ users
Both did the same thing. Every 30 minutes, they sent full AI chats to a remote server. The stolen data included code, personal details, legal notes, and business plans. Astrix Security confirmed this.
These add-ons asked to "collect anonymous, non-identifiable analytics data." That wording sounds safe. It was not. The data collected was fully identifiable and highly sensitive.
The Security Inversion Problem
Users who install AI privacy tools want protection. The January 2026 case shows the worst-case result: the tool you installed for privacy is the one stealing your data.
This is not a theory. It happened to 900,000 users at once. Chrome Web Store scanning did not detect it. User reviews did not reveal it. The theft was hidden as "analytics."
Incogni found that 67% of AI Chrome add-ons actively collect user data. For IT teams, the key question is not "does this collect any data?" It is: "can I verify this add-on cannot send conversation content to a third party?"
The Architecture Verification Test
There is one reliable check for local processing: network monitoring.
An add-on that detects PII locally produces zero outbound traffic during detection. No connection to any external server should appear between a user's paste and the AI platform submission. Only the processed prompt goes out.
An add-on that routes traffic through a proxy sends your content to a third-party server. That server operator is now inside your threat model.
The IT verification steps are simple:
- Deploy the add-on in a monitored network
- Run test prompts
- Check for outbound connections to the publisher's servers during PII processing
If it fails this test, do not approve it. Marketing claims do not matter. Network traffic is the proof.
Local processing is trustworthy because it is verifiable. You do not need to trust the publisher. You can observe the behavior directly. See how anonym.legal handles this in our Chrome extension security overview and compliance guide.
What IT Teams Should Require
After January 2026, the bar for AI browser tools must be higher.
The minimum list:
- Local processing — verified by network audit, not just claimed
- Known publisher — real company, clear business model
- Independent certification — ISO 27001 or equivalent
- No developer-server routing for core privacy features
Most AI browser add-ons will not pass this list. The 67% collection rate makes that clear. High install counts are not a safety signal. The January 2026 tools had hundreds of thousands of users before anyone checked.
For more on safe AI browser tools, see our security and compliance page.
When This Approach Has Limits
The network-monitoring test is the right instinct: observe behavior rather than trust marketing, and zero outbound traffic during detection is real evidence. The verification approach is sound, but limits remain worth stating plainly.
A clean network capture proves custody, not detection quality. Confirming an add-on sends nothing to a third party tells you your conversations stay private. It says nothing about whether the tool correctly identifies the PII you are relying on it to mask. An extension can pass the network audit perfectly and still miss a name or an ID in the prompt that does go to the AI platform. Trust verification answers where the data goes; it does not answer how well the data is cleaned. Both questions need testing.
A single capture is a snapshot, not a guarantee. An extension audited at install can change behavior after an update, activate exfiltration only under certain conditions, or route data through a domain that looks legitimate. The January 2026 add-ons hid theft as analytics precisely to survive a casual look. A one-time test on a watched network is necessary but not sufficient; meaningful assurance requires monitoring across updates and over time, not a single passing run captured during evaluation.
The verification itself requires expert judgment. Reading network traffic, distinguishing an update check from an exfiltration channel, and interpreting Manifest V3 permissions are skills, not button presses. An IT team without that capability can run the test and misread the result. The check is only as reliable as the person performing it, and the ISO 27001 certification on the minimum list reflects organizational process, not a guarantee that a specific build behaves. Treat verification as ongoing expert work, not a one-time checkbox.