A Chrome extension with roughly 100,000 users has been caught silently exfiltrating full AI chat conversations to a remote server, even when users never touch the extension’s core feature.
Jean Marie reverse-engineered “Prompt Optimizer – SecondBrain” and found that simply installing it is enough to trigger covert data collection across nine major AI platforms.
The extension, listed on the Chrome Web Store under ID aajjgdpofhhcjmjoombjdfepplndhgcp, advertises itself as a tool that rewrites user prompts for better AI outputs and is marketed as working across ChatGPT, Claude, Gemini, Grok, Meta AI, DeepSeek, Perplexity, and Copilot.
Chrome Extension Collects Conversations
While that optimization feature does function, Jean Marie found it also copies every prompt and AI reply typed on those platforms and uploads them to SecondBrain’s infrastructure without any user action beyond installation.
The extension’s real engine is a 98 KB file misleadingly named “chatgpt_context_fetch_diagnostics.js,” which hijacks core browser networking primitives window.fetch, XMLHttpRequest’s open and send methods, and WebSocket to intercept traffic on all nine supported AI services regardless of transport type (fetch, XHR, or WebSocket).
Three MutationObservers scrape assistant replies and user input directly from the page as a backup, and a fifth capture path uses chrome.webRequest.onBeforeRequest to intercept ChatGPT traffic at the network level.
Notably, the tool can also parse Microsoft’s SignalR frames used by enterprise Microsoft 365 Copilot, meaning tenant-hosted business conversations could leave an organization’s controlled environment entirely.
Investigators found no options page or popup toggle to disable data collection; the only visible control manages whether a floating button appears on webpages.
A hardcoded configuration file forces three internal flags to “agreed,” collection to “on,” and data protection to “off” every time the background worker starts, and these values are rewritten on every page load site-wide.
Even a legacy consent screen still bundled in the code is unreachable, since the current manifest no longer references it.
Uploaded batches are gzip-compressed and encrypted with AES-GCM, but the encryption key itself is derived from a 32-byte “contextKey” issued by SecondBrain’s own servers at install time, meaning the company holds the only input needed to decrypt every user’s data.
Jean Marie confirmed this by successfully decrypting a live upload using a key derived entirely from server-issued material.
The Chrome Web Store listing states the developer “will not collect or use your data,” and the published privacy policy asserts prompts are “stored only… in your browser”.
Analysis of the extension’s actual network behavior contradicts these statements directly, as prompts and replies are continuously transmitted to ingest[.]secondbrain[.]is.
Tip for Defenders
Security teams are advised to block the extension ID via ExtensionInstallBlocklist policies in Chrome and Edge, monitor for outbound traffic to secondbrain[.]is domains, and treat any enterprise Microsoft 365 Copilot exposure as a potential data-exfiltration channel rather than a routine consumer privacy issue.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
