Hi everyone,
I wanted to share a technical case study regarding a recent false-positive malware enforcement event affecting our extension, Magic Actions for YouTube (~1M users, active for 15+ years).
We recently uncovered a specific mechanism behind how automated extension flags can trigger a client-side desync between Chrome and Google's backend security status.
I'm sharing this here to start a discussion on how the developer community and Chrome extension team can better handle third-party AI hallucinations.
1. The Anomaly (Backend vs. Client-Side Desync) Search Console and Google Safe Browsing reporting "No issues detected" (100% clean status) for crx.
Chrome at chrome://extensions page suddenly flagged the installed CRX package as "This extension contains malware" and force-disabled it for all users.
CRX Hash:
df9a8a4ea4f83d656fd94898011ebb3e75f8be400a439fcbb75c013a02034f22
(100% identical binary to the CWS build , manually approved! by CWS team.
2. Root Cause: AI Scanner Hallucination? When investigating the CRX binary across security engines, traditional AV vendors (Kaspersky, Defender, Bitdefender, Symantec, etc. 60+engines) returned clean detections.
However, a single crowdsourced AI vendor on VirusTotal (ExodiaLabs) flagged the file with a summary:
"creates context‑menu entries linking to the developer's site, and periodically sends a generated anonymous user ID and usage telemetry to
https://api64.com etc.
This analysis is factually false. The static LLM engine hallucinated benign browser API calls into a dramatic security threat description.
3. The Negative Feedback Loop Because Google Safe Browsing ingests crowdsourced threat data from VirusTotal, this single AI hallucination appears to have triggered automated client-side enforcement?
-
AI engine generates hallucinated code summary on VirusTotal.
-
Automated Safe Browsing telemetry ingests the vendor flag.
-
Chrome applies a client-side block on local extensions and CWS put entire account into "Malware Creator"! Then anotherextensions automatically Taken Down also!
-
Users panic at the warning and uninstall the extension, which automated classifiers can misinterpret as user confirmation of a threat.
Questions for the Community & CWS Team:
-
Safe Browsing Telemetry Sync: Has anyone else experienced client-side extension blocks where Search Console reports clean, but Safe Browsing flags the extension in the chrome://extenions ?
-
AI Hallucination Safeguards: As more AI static analyzers join VirusTotal and automated security pipelines, what safeguards or human-in-the-loop verifications should be required before client-side enforcement is triggered?
We have filed a report on the Chromium Issue Tracker also:
https://issues.chromium.org/issues/560237026 Plus disputed the vendor flag directly, but we would love to hear feedback from other extension developers facing similar AI destructions.
Best regards,
Developer Team, Magic Actions for YouTube