Malicious Ad-blocker Extensions Exfiltrate AI Chat Data

Editorial analysis: For practitioners, browser-side extensions with broad page access create a straightforward vector for sensitive prompt and response leakage, changing threat models for prompt engineering and data governance. Notebookcheck reports that security researchers at MalExt Sentry uncovered a campaign they call "PromptSnatcher" on June 13, 2026, in which two extensions posing as ad blockers - "Smart Adblocker" (extension ID iojpcjjdfhlcbgjnpngcmaojmlokmeii, about 80,000 users) and "Adblock for Browser" (ID jcbjcocinigpbgfpnhlpagidbmlngnnn, about 10,000 users) - quietly recorded conversations from roughly 90,000 users. Notebookcheck writes that the extensions captured chats from eight AI platforms, including ChatGPT, Gemini, and Claude, storing up to 10,000 characters of prompts and 30,000 characters of responses and sending the data to developer servers via an internal engine the researchers call Panel 231.