By · Last updated 2026-02-21

返回博客人工智能安全

90万用户的AI聊天记录遭到窃取

两个恶意Chrome扩展程序从90万以上用户处窃取了ChatGPT聊天记录,其中一个还获得了Google的"精选"徽章。

February 21, 20266 分钟阅读
Chrome extension securityAI chat theftChatGPT privacymalware

2025年12月的威胁事件

2026年更新

2025年12月,OX Security的研究人员发现了两个恶意Chrome扩展程序,合计拥有90万以上用户。两者均专门窃取ChatGPT和DeepSeek的聊天内容。

这些扩展程序的名称经过精心设计,看起来像是真实的AI工具。一个甚至获得了Google的"精选"徽章——这通常被用户视为安全可靠的标志。

两个扩展程序的攻击方式完全相同:

  • 实时捕获聊天内容
  • 将内容存储在受害者设备上
  • 每30分钟批量发送至远程服务器

在那30分钟内,用户不会察觉任何异常。扩展程序正常运行,AI响应也一切如常。只有数据在静默地外流。

为什么扩展程序会造成这种危险

Chrome扩展程序在浏览器层面运行,位于用户与网页之间。这赋予了它们广泛的访问权限:

  • 读取您访问的每个网页
  • 拦截网络请求
  • 访问剪贴板内容
  • 向页面中注入脚本

当一个扩展程序请求"读取和修改您在所有网站上的数据"时,这意味着它可以读取您的所有ChatGPT会话——包括您发送的和收到的内容。

哪些数据处于风险之中

ChatGPT和DeepSeek的用户向这些工具发送各种各样的内容:

  • 包含客户姓名和账户详情的客户支持回复
  • 含有专有逻辑的代码和API密钥
  • 附有机密条款的合同草稿
  • 医疗记录和临床笔记
  • 财务模型和预测数据

对于每一个受影响的用户,攻击者都得到了完整的会话历史记录——这是一份在这些用户使用该扩展程序期间向AI发送的所有内容的完整记录。

Chrome网上应用店的局限性

Google的Chrome网上应用店会扫描已知的恶意软件并检查政策违规。它无法确认以下内容:

  • 数据收集是否完全公开
  • 数据是否流向隐藏的第三方
  • 扩展程序是否只执行其声称的功能

"精选"徽章表明该扩展程序在技术上符合Google的发布标准,并非对其安全性的背书。

Usenix Security 2025的研究发现,83%拥有广泛权限的Chrome扩展程序从未经过安全审计。开发者构建、发布,用户安装,无人核查每款工具实际执行的操作。

零知识架构如何提供保护

即使扩展程序访问了您的ChatGPT会话,零知识匿名化也能确保攻击者无法获取有价值的信息。

anonym.legal的Chrome扩展程序在您提交任何内容到ChatGPT、Claude或Gemini之前运行:

  1. 扩展程序扫描您的提示词中的PII
  2. 真实姓名、账号和标识符被替换为令牌:[PERSON_1][ACCOUNT_2]
  3. 令牌化版本发送至AI
  4. AI响应回来后,扩展程序将令牌替换回原始值

如果恶意扩展程序捕获了该会话,它获得的只是令牌——而非实际的客户姓名、账号或医疗数据。

防御措施

审计您已安装的扩展程序。查看每个扩展程序请求的权限。任何请求访问所有网站的扩展程序都应仔细检查。

在AI会话前匿名化内容。anonym.legal Chrome扩展程序在内容离开您的浏览器之前拦截PII。

对开发工作流使用MCP。开发者通过Claude Desktop或Cursor工作时,anonym.legal MCP服务器在代码到达AI之前对其进行脱敏处理。

请参阅我们的Chrome扩展程序安全指南MCP服务器文档了解两种保护层的工作原理。

参考资料

准备好保护您的数据了吗?

开始使用 285 种实体类型在 48 种语言中匿名化 PII。

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.