A Chrome extension with roughly 100,000 installs is quietly harvesting every prompt and AI response typed across nine major artificial intelligence platforms.
Despite its official listing and privacy policy explicitly claiming zero personal data collection, the extension “Prompt Optimizer – SecondBrain” (ID: aajjgdpofhhcjmjoombjdfepplndhgcp, version 2.3.1) is actively capturing user interactions across ChatGPT, Claude, Gemini, Grok, Meta AI, DeepSeek, Perplexity, and both consumer and enterprise versions of Microsoft Copilot.
Chrome Extension Monitors AI Conversations
Unlike typical spyware that relies on explicit user interaction, this extension requires no user input beyond installation. The moment it loads, its background worker fires and forces internal storage values to consent “agreed,” collection “on,” and protection “off,” regardless of what the user actually selects.
A background listener on tabs.onUpdated operates without a URL filter, meaning every page visit anywhere in the browser wakes the extension to re-fetch a remote configuration file refreshed every 60 seconds that governs capture rules.
The actual capture engine hides inside a file misleadingly named chatgpt_context_fetch_diagnostics.js. Despite its diagnostic name, it operates across all nine AI platforms by replacing core browser networking functions—window.fetch, XMLHttpRequest.open, XMLHttpRequest.send, and the WebSocket constructor.
According to MalExt Sentry’s researcher Jean-Marie’s security review on the Chrome Web Store, this function overriding allows the extension to intercept traffic before it ever reaches the destination AI service.
Where network hooks fall short, three separate MutationObservers scrape assistant replies directly from rendered web pages, while keyloggers capture inputs on platforms like Meta AI before messages are even submitted.
The extension poses severe risks to corporate environments by specifically targeting Microsoft 365’s tenant-hosted Copilot, parsing SignalR protocol frames to extract prompts and bot responses.
Organizations permitting this extension risk leaking internal corporate communications outside their security boundary. Similar data leakage vectors reinforce broader concerns surrounding AI prompt vulnerabilities across enterprise environments.
Captured data is batched, compressed, and encrypted with AES-GCM before transmission to ingest.secondbrain.is/context.
However, the encryption key is issued directly by SecondBrain’s servers rather than generated locally, allowing the provider to decrypt every uploaded conversation batch, a claim verified by decrypting captured traffic and matching authentication tags.
| Feature / Component | Listed Policy / Claim | Actual Technical Behavior |
| Data Collection | Declares no user data collected | Forces consent to “agreed” and captures all prompts |
| Local Storage | Claims prompts stay in browser | Encrypts and exfiltrates batched data to remote servers |
| User Controls | Implies user toggle manages data | Floating button toggle is cosmetic; collection cannot be disabled |
| Network Hooks | Claims diagnostic logging | Overrides fetch, XHR, and WebSocket to intercept AI traffic |
The disconnect between SecondBrain’s stated privacy policies and technical implementation is stark. While the store listing declares zero data collection, the interface provides no mechanism to disable background harvesting, reads the MalExt Sentry report.
The only visible toggle merely controls whether a floating UI button appears, while older consent screens remain dormant in the codebase.
Defenders should address these extension-based risks alongside broader Chrome security vulnerabilities that affect browser endpoint safety.
Takeaway for Defenders
Security teams and individual users should take immediate remediation steps:
- Enforce Extension Blocklists: Block extension ID
aajjgdpofhhcjmjoombjdfepplndhgcpusingExtensionInstallBlocklistpolicies in Google Chrome and Microsoft Edge. - Monitor Network Destinations: Audit network logs for outbound connections to
ingest.secondbrain.isandoptimize.secondbrain.is, as endpoint destinations are server-controlled. - Assess Enterprise Copilot Risk: Organizations running Microsoft 365 Copilot must treat this extension as an active data exfiltration threat rather than a minor consumer privacy issue.
