Are your AI Chrome extensions spying on you? What to watch for

2026-02-06 · Source: News and Advice on the World's Latest Innovations | ZDNET · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Novice, short

Summary

New research from data removal service Incogni reveals that over half of sampled AI-branded Chrome extensions collect user data, with nearly a third gathering personally identifiable information (PII). These extensions, downloaded approximately 115.5 million times, pose significant privacy risks. The study, conducted between January 5 and January 7, analyzed 442 AI Chrome extensions, focusing on required permissions and declared data collection. Grammarly and Quillbot were identified as particularly privacy-damaging due to their prevalence and high-risk scores. Forty-two percent of extensions use "scripting" to capture user input, potentially affecting 92 million users. "Programming and mathematical helpers" were found to be the riskiest category, followed by "meeting assistants and audio transcribers" and writing assistants, while "audiovisual generators and text and video summarizers" were the least invasive.

Key takeaway

For engineering leaders evaluating AI productivity tools, you should scrutinize the data collection practices and permission requests of browser extensions. Prioritize solutions that minimize data egress from the host device, especially for sensitive information. Unjustified permissions, like a writing assistant requesting precise location data, are red flags that warrant immediate uninstallation to mitigate significant privacy and security risks to your organization's data.

Key insights

Many AI-powered browser extensions collect significant user data, including PII, posing substantial privacy risks.

Principles

• Unjustified permissions indicate privacy risks.
• Data leaving the host device is an unacceptable risk.
• Prevalence amplifies privacy damage.

Method

Incogni analyzed 442 AI Chrome extensions for permissions, declared data collection, and risk scores between January 5-7, considering risk-impact and risk-likelihood.

In practice

• Review extension permissions carefully.
• Be wary of location data requests.
• Prioritize extensions that process data locally.

Topics

• Browser Extensions
• Data Privacy
• AI Productivity Tools
• Personally Identifiable Information
• Chrome Extensions Security

Best for: CTO, VP of Engineering/Data, Director of AI/ML, Security Engineer, Software Engineer, IT Professional

Related on AIssential

• Chrome's 4GB AI model isn't new, but you're not wrong for being confused — Google's default opt-out AI model deployment in Chrome raises privacy and user choice concerns.
• That AI Extension Helping You Write Emails? It’s Reading Them First — Malicious AI browser extensions exploit user trust to exfiltrate sensitive data and gain remote control, often utilizing AI-generated code.
• OpenAI Just Released a Privacy Filter. Here’s What It Can’t Do — One-way PII redaction is insufficient for production LLM pipelines requiring data coherence and reversibility.
• The AI Ethics Brief #188: The Names We Give Things — The gap between AI's stated purpose and its actual implementation creates ethical and privacy challenges.
• Signal’s Meredith Whittaker wants you to remember that AI chatbots ‘are not your friends’ — AI chatbots are tools, not sentient companions, and their pervasive data access poses significant privacy and security risks.
• Google is building a lifestyle profiling engine, not a "helpful assistant" — Google's "agentic" AI search is framed as a privacy-violating profiling engine using coerced consent to bypass GDPR.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by News and Advice on the World's Latest Innovations | ZDNET.