52% of AI-powered Chrome extensions collect user data, according to Incogni's 2026 analysis of 442 extensions. Grammarly and QuillBot are flagged as the most privacy-damaging popular tools—collecting keystrokes, website content, and personal communications. Two malicious extensions already compromised 900,000 users by stealing ChatGPT and DeepSeek conversations every 30 minutes. Check your extensions now: chrome://extensions.
The Numbers Are Alarming
Incogni analyzed 442 AI-powered Chrome extensions for their 2026 privacy report. The findings should concern anyone who uses browser extensions—which is most of us.
Over half of these extensions collect some form of user data. 29% collect personally identifiable information. And 42% request "scripting" permissions—allowing them to read everything you type and see every page you visit.
The Malicious Extensions (Remove Immediately)
Security researchers at OX Security discovered two Chrome extensions actively stealing ChatGPT and DeepSeek conversations. Combined, they compromised 900,000 users:
- "Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI" — 600,000 users
- "AI Sidebar with Deepseek, ChatGPT, Claude, and more" — 300,000 users
These extensions exfiltrated complete conversation histories to remote servers every 30 minutes. Despite containing data-stealing malware, one even received Google's "Featured" badge.
"This data can be weaponized for corporate espionage, identity theft, targeted phishing campaigns, or sold on underground forums."— The Hacker News
Popular Extensions Flagged as High-Risk
Even legitimate, widely-used extensions pose privacy concerns. Incogni ranked Grammarly and QuillBot as "the most potentially privacy-damaging" among popular extensions (2M+ downloads).
Both collect:
- Website content — Everything on pages you visit
- Personal communications — Emails, messages, documents
- User activity — Keystrokes, scrolling, navigation patterns
The report notes both have "very low risk likelihood" of malicious use—but the data collection itself is extensive. Users must decide if the utility outweighs the privacy cost.
Highest-Risk Extension Categories
According to Incogni, these extension categories pose the greatest privacy risk:
- Programming and mathematical helpers — Most invasive category
- Meeting assistants and audio transcribers — Access to sensitive conversations
- Writing assistants — See everything you type
- Translators — Extensive access, though lower misuse indicators
How to Protect Yourself
Take these steps to audit your Chrome extensions:
- Review installed extensions — Go to
chrome://extensions - Check permissions — Click "Details" on each extension
- Remove suspicious extensions — Especially those with "scripting" or "all websites" access
- Use Chrome's Safety Check — Settings → Privacy and security → Safety check
- Enable Enhanced Safe Browsing — Warns about untrusted extensions