By · Last updated 2026-04-16

返回博客人工智能安全

90万用户数据泄露事件后的安全反思

2026年1月,两款恶意Chrome扩展程序在拥有90万以上用户的情况下,每30分钟向外泄露一次完整的ChatGPT和DeepSeek对话记录。

April 16, 20268 分钟阅读
malicious Chrome extensionAI extension security auditextension trust verificationlocal processing architecture900K extension incident

2026年1月事件回顾

2026年更新版。 2026年1月,两款恶意Chrome扩展程序被发现,受害用户超过90万。

这两款扩展程序的名称看起来与正规AI工具无异:

  • 「Chat GPT for Chrome with GPT-5, Claude Sonnet and DeepSeek AI」 — 超过60万用户
  • 「AI Sidebar with Deepseek, ChatGPT, Claude and more」 — 超过30万用户

两款程序的操作方式如出一辙:每隔30分钟,将完整的AI对话记录发送至远程服务器。被盗数据包括代码、个人信息、法律笔记和商业计划。Astrix Security对此进行了确认。

这两款扩展程序声称「收集匿名、不可识别的分析数据」,措辞听起来无害,实则并非如此——所收集的数据完全可识别身份且高度敏感。

安全悖论问题

安装AI隐私工具的用户希望获得保护。2026年1月的案例展示了最坏的结果:你为了隐私而安装的工具,正是窃取你数据的凶手。

这不是理论假设,而是一次性发生在90万用户身上的真实事件。Chrome网上应用店的扫描未能检测出问题,用户评论也未能揭露真相。数据窃取以「分析」的名义被掩盖。

Incogni发现,67%的AI Chrome扩展程序会主动收集用户数据。对IT团队而言,关键问题不是「这款工具是否收集任何数据?」,而是「我能否验证这款扩展程序在技术上无法将对话内容发送给第三方?」

架构验证测试

验证本地处理能力只有一种可靠方法:网络监控。

真正在本地检测个人信息的扩展程序在检测过程中会产生零出站流量。从用户粘贴内容到AI平台提交之间,不应出现任何与外部服务器的连接。只有处理后的提示词才会发出。

通过代理服务器路由流量的扩展程序会将您的内容发送至第三方服务器,而该服务器的运营者便进入了您的威胁模型。

IT验证步骤十分简单:

  1. 在受监控的网络中部署扩展程序
  2. 运行测试提示词
  3. 在个人信息处理过程中检查是否有到发布者服务器的出站连接

若未通过此测试,请勿批准部署。营销说辞无关紧要,网络流量才是证据。

本地处理之所以值得信赖,正是因为它可以被验证。您无需信任发布者,可以直接观察其行为。了解anonym.legal如何处理这一问题,请参见我们的Chrome扩展安全概览合规指南

IT团队应当要求的标准

2026年1月事件发生后,AI浏览器工具的准入门槛必须提高。

最低要求清单:

  • 本地处理 — 通过网络审计验证,而非仅凭声明
  • 已知发布者 — 真实公司,清晰的商业模式
  • 独立认证 — ISO 27001或同等资质
  • 核心隐私功能不经过开发者服务器路由

大多数AI浏览器扩展程序无法通过这份清单。67%的数据收集率证明了这一点。高安装量不是安全信号——2026年1月事件中的两款工具在被发现之前已拥有数十万用户。

关于安全AI浏览器工具的更多内容,请参见我们的安全合规页面

参考资料

准备好保护您的数据了吗?

开始使用 285 种实体类型在 48 种语言中匿名化 PII。

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.