AI Hallucinations Trigger Malware Flag on 1M+ Active User Extension

Magic Actions for YouTube, a Chrome extension with roughly 1 million users and 15+ years of operation, was force-disabled for all users after Chrome flagged its CRX package as containing malware, while Google Search Console and Google Safe Browsing reported a 100% clean status for the same binary. The developer team attributes the enforcement to a single crowdsourced AI vendor, ExodiaLabs, on VirusTotal that flagged the file with a factually false summary about context-menu entries and anonymous telemetry sent to api64.com, a flag the team says was ingested by Safe Browsing telemetry and triggered automated client-side blocking plus a "Malware Creator" designation on the account. The team has filed a report on the Chromium Issue Tracker (issue 560237026) and disputed the vendor flag, asking what human-in-the-loop safeguards should be required before AI static analyzers can trigger client-side enforcement.

Hi everyone, I wanted to share a technical case study regarding a recent false-positive malware enforcement event affecting our extension, Magic Actions for YouTube ~1M users, active for 15+ years . We recently uncovered a specific mechanism behind how automated extension flags can trigger a client-side desync between Chrome and Google's backend security status. I'm sharing this here to start a discussion on how the developer community and Chrome extension team can better handle third-party AI hallucinations. 1. The Anomaly Backend vs. Client-Side Desync Search Console and Google Safe Browsing reporting "No issues detected" 100% clean status for crx. Chrome at chrome://extensions page suddenly flagged the installed CRX package as "This extension contains malware" and force-disabled it for all users. CRX Hash: df9a8a4ea4f83d656fd94898011ebb3e75f8be400a439fcbb75c013a02034f22 100% identical binary to the CWS build , manually approved by CWS team. 2. Root Cause: AI Scanner Hallucination? When investigating the CRX binary across security engines, traditional AV vendors Kaspersky, Defender, Bitdefender, Symantec, etc. 60+engines returned clean detections. However, a single crowdsourced AI vendor on VirusTotal ExodiaLabs flagged the file with a summary: "creates context‑menu entries linking to the developer's site, and periodically sends a generated anonymous user ID and usage telemetry to https://api64.com https://api64.com etc. This analysis is factually false. The static LLM engine hallucinated benign browser API calls into a dramatic security threat description. 3. The Negative Feedback Loop Because Google Safe Browsing ingests crowdsourced threat data from VirusTotal, this single AI hallucination appears to have triggered automated client-side enforcement? 1. AI engine generates hallucinated code summary on VirusTotal. 2. Automated Safe Browsing telemetry ingests the vendor flag. 3. Chrome applies a client-side block on local extensions and CWS put entire account into "Malware Creator" Then anotherextensions automatically Taken Down also 4. Users panic at the warning and uninstall the extension, which automated classifiers can misinterpret as user confirmation of a threat. Questions for the Community & CWS Team: 1. Safe Browsing Telemetry Sync: Has anyone else experienced client-side extension blocks where Search Console reports clean, but Safe Browsing flags the extension in the chrome://extenions ? 2. AI Hallucination Safeguards: As more AI static analyzers join VirusTotal and automated security pipelines, what safeguards or human-in-the-loop verifications should be required before client-side enforcement is triggered? We have filed a report on the Chromium Issue Tracker also: https://issues.chromium.org/issues/560237026 https://issues.chromium.org/issues/560237026 Plus disputed the vendor flag directly, but we would love to hear feedback from other extension developers facing similar AI destructions. Best regards, Developer Team, Magic Actions for YouTube https://www.chromeactions.com https://www.chromeactions.com