# AI Hallucinations Trigger Malware Flag on 1M+ Active User Extension

> Source: <https://groups.google.com/a/chromium.org/g/chromium-extensions/c/dG_VSqyli1A>
> Published: 2026-09-12 03:10:17+00:00

Hi everyone,

I wanted to share a technical case study regarding a recent false-positive malware enforcement event affecting our extension, Magic Actions for YouTube (~1M users, active for 15+ years).

We recently uncovered a specific mechanism behind how automated extension flags can trigger a client-side desync between Chrome and Google's backend security status. 

I'm sharing this here to start a discussion on how the developer community and Chrome extension team can better handle third-party AI hallucinations.

**1. The Anomaly (Backend vs. Client-Side Desync)**
Search Console and Google Safe Browsing reporting "No issues detected" (100% clean status) for crx.

Chrome at chrome://extensions page suddenly flagged the installed CRX package as "This extension contains malware" and force-disabled it for all users.

CRX Hash:

 df9a8a4ea4f83d656fd94898011ebb3e75f8be400a439fcbb75c013a02034f22 

(100% identical binary to the CWS build , manually approved! by CWS team.

**2. Root Cause: AI Scanner Hallucination?**
When investigating the CRX binary across security engines, traditional AV vendors (Kaspersky, Defender, Bitdefender, Symantec, etc. 60+engines) returned clean detections.

However, a single crowdsourced AI vendor on VirusTotal (ExodiaLabs) flagged the file with a summary:

"creates context‑menu entries linking to the developer's site, and periodically sends a generated anonymous user ID and usage telemetry to 

[https://api64.com](https://api64.com)
 etc.

This analysis is factually false. The static LLM engine hallucinated benign browser API calls into a dramatic security threat description.

**3. The Negative Feedback Loop**
Because Google Safe Browsing ingests crowdsourced threat data from VirusTotal, this single AI hallucination appears to have triggered automated client-side enforcement?

1. AI engine generates hallucinated code summary on VirusTotal.

2. Automated Safe Browsing telemetry ingests the vendor flag.

3. Chrome applies a client-side block on local extensions and CWS put entire account into "Malware Creator"! Then anotherextensions automatically Taken Down also!  

4. Users panic at the warning and uninstall the extension, which automated classifiers can misinterpret as user confirmation of a threat.

**Questions for the Community & CWS Team:**
1. Safe Browsing Telemetry Sync: Has anyone else experienced client-side extension blocks where Search Console reports clean, but Safe Browsing flags the extension in the chrome://extenions ?

2. AI Hallucination Safeguards: As more AI static analyzers join VirusTotal and automated security pipelines, what safeguards or human-in-the-loop verifications should be required before client-side enforcement is triggered?

We have filed a report on the Chromium Issue Tracker also:

[https://issues.chromium.org/issues/560237026](https://issues.chromium.org/issues/560237026)
Plus disputed the vendor flag directly, but we would love to hear feedback from other extension developers facing similar AI destructions.

Best regards,

Developer Team, Magic Actions for YouTube

[https://www.chromeactions.com](https://www.chromeactions.com)