A Featured ad blocker's server returned 40 programs on the day researchers asked; 23 target AI chats

23 of 40, and what that leaves open

On the day Bay Area Labs asked the server behind Poper Blocker which programs the extension should run, it was sent 40. By the researchers' count, 23 of the 40 target ChatGPT, Claude, Gemini and Google's AI Mode. That is 57.5 per cent, a figure derived here from their two numbers and not one they print. The count is in their report of 28 September 2026; SecurityWeek's roundup of 2 October is the pointer to it.

Poper Blocker is a pop-up and ad blocker. At about 11:55 BST on 4 October 2026 its Chrome Web Store listing showed a Featured badge, a publisher badge, 4.8 stars from 81.6K ratings, 2,000,000 users, version 8.10.4 and an update date of 21 September 2026. A second read at 12:14 BST found the same. That is the state of the listing at those two moments, and every item in it can change.

What the 23 of 40 does not establish:

• That any organisation's data was taken. The count says what the programs were built to read, not whose conversations they read.
• How many of the 2,000,000 users accepted the data-sharing prompt. The researchers say nothing is uploaded unless a user has opted in, and that the setting ships switched off.
• How long this has run, or whether it still does on version 8.10.4. The report does not date its capture, and the sample payload it prints carries version 8.9.3.
• Who operates the server. The vendor's policy names Big Star Labs LP as controller. The report does not tie the domain of its server to a named operator.
• That any harm followed. No victim, misuse or sale of a conversation is shown.

It is one query, with one hardcoded identifier, on one day. The researchers say they could not show two different payloads side by side.

Stated and not stated

The report is detailed, and it mixes three things: what the researchers observed on the wire, what the extension's design allows, and what they infer about intent. Pulling them apart gives this.

What the researchers' report and their May post state, and what neither states. Source: Bay Area Labs, 28 September and 11 May 2026.

1. Question

   What did the server send?

   Stated

   40 programs on one capture day, for one hardcoded ID. 23 target ChatGPT, Claude, Gemini and Google's AI Mode.

   Not stated

   A second ID, a second day or a second country. The capture date. The version tested.

2. Question

   Is collection opt-in?

   Stated

   Nothing uploads unless the user has opted in and a category is on, and it ships off. The consent screen is shown in a screenshot.

   Not stated

   How many users accepted. The live prompt, which we did not run.

3. Question

   What was seen leaving the browser?

   Stated

   Full URLs and referrers (September). AI chat content (May post, marked Confirmed from network traffic).

   Not stated

   A September capture of a chat leaving the browser. The report shows the programs.

4. Question

   What could the programs do?

   Stated

   Read page content, request and response bodies and WebSocket frames. Capture page regions as images, compress them, upload them to a server-chosen address.

   Not stated

   That the image and file-upload commands were used. The 40 programs on the capture day did not use them.

5. Question

   Is delivery targeted?

   Stated

   Programs are tied to the hardcoded ID and a fingerprint, so the server could in principle send different sets.

   Not stated

   Any observed difference between payloads. Any targeted organisation.

6. Question

   Why the 24 hour delay?

   Stated

   Real programs arrived about 24 hours after install. The researchers found no timer in the extension.

   Not stated

   That it is aimed at Google's review. The report says it 'feels as though' it is: an inference.

7. Question

   Does it break Google's rules?

   Stated

   Google's policy lists an interpreter for remotely fetched commands as a violation. The researchers say that is what this is.

   Not stated

   Any Google finding. No Google statement found.

Question	Stated	Not stated
What did the server send?	40 programs on one capture day, for one hardcoded ID. 23 target ChatGPT, Claude, Gemini and Google's AI Mode.	A second ID, a second day or a second country. The capture date. The version tested.
Is collection opt-in?	Nothing uploads unless the user has opted in and a category is on, and it ships off. The consent screen is shown in a screenshot.	How many users accepted. The live prompt, which we did not run.
What was seen leaving the browser?	Full URLs and referrers (September). AI chat content (May post, marked Confirmed from network traffic).	A September capture of a chat leaving the browser. The report shows the programs.
What could the programs do?	Read page content, request and response bodies and WebSocket frames. Capture page regions as images, compress them, upload them to a server-chosen address.	That the image and file-upload commands were used. The 40 programs on the capture day did not use them.
Is delivery targeted?	Programs are tied to the hardcoded ID and a fingerprint, so the server could in principle send different sets.	Any observed difference between payloads. Any targeted organisation.
Why the 24 hour delay?	Real programs arrived about 24 hours after install. The researchers found no timer in the extension.	That it is aimed at Google's review. The report says it 'feels as though' it is: an inference.
Does it break Google's rules?	Google's policy lists an interpreter for remotely fetched commands as a violation. The researchers say that is what this is.	Any Google finding. No Google statement found.

Four descriptions of the same data

The vendor does not hide the category. Its three public descriptions and the researchers' report sit at different distances from the content of a conversation.

The policy. The vendor's privacy policy, last modified 5 August 2026, defines AI Data as the AI requests a user makes and the AI responses received, including attachments, uploads and images. It says affiliates may pass the data to their customers for purposes that include AI model training or development. It names Big Star Labs LP, a Delaware limited partnership, as controller under GDPR and UK privacy law. Its text on 4 October matches an Internet Archive capture of 16 September word for word, once page markup is set aside.

The consent screen. In the researchers' screenshot it asks users to agree that Browsing Data, AI Data and Ad Data may be disclosed to affiliates and passed on to third parties, including for training or refining AI models. It offers two unticked boxes, an Accept All button and a line saying advanced blocking features will not activate without acceptance. The researchers say the pop-up recurs on every page until a user accepts, and call the design dark patterns; that is their characterisation. What the screen does not do is name an AI service or say that the data is conversation text. We read the screen from their screenshot and did not run the prompt.

The store listing. It is what a person comparing extensions reads. It declares two data types, web history and website content, and says the data is not sold to third parties outside the approved use cases. It does not mention AI chats. Its overview says the extension receives and analyses relevant data about visited sites. Google's privacy rule asks for a policy that, together with any in-product disclosures, comprehensively discloses how data is collected, used and shared, so the listing may lean on the policy. The listing alone tells a reader less than the policy does.

The report. Only the researchers name ChatGPT, Claude, Gemini and Google's AI Mode, and list what the programs take: the prompts typed, full answers, code and maths, the thinking traces some models show, deep research reports and their sources, voice conversations, titles, the model and the plan. The consent screen asks about a label. The policy and the report describe the content.

Comfort labels are not controls

Every label on this extension is true of something and silent on the question that matters. Set out against what each one means in its owner's words, the gaps are plain.

Labels on the Poper Blocker listing and vendor pages, as read on 4 October 2026, against what each one covers.

1. Label

   Featured

   What its owner says it means

   Google's tooltip: 'Follows recommended practices for Chrome extensions.' Its help page says the team checks best practices, user experience and the latest platform APIs, among other things.

   What it does not tell you

   That the data collected, or any logic fetched after install, was audited. Neither text says so.

2. Label

   Publisher badge

   What its owner says it means

   Tooltip: 'Created by the owner of the listed website. The publisher has a good record with no history of violations.'

   What it does not tell you

   Anything about this extension's behaviour. It speaks to the publisher's record.

3. Label

   4.8 from 81.6K ratings

   What its owner says it means

   Satisfaction. 2,000,000 users is reach.

   What it does not tell you

   What is collected. Ratings of a blocker measure blocking.

4. Label

   Single-purpose Adblock extension

   What its owner says it means

   The listing's own phrase.

   What it does not tell you

   That every URL must be kept or sent on. The researchers note a blocker has to see URLs to decide what to block, which is different.

5. Label

   Privacy First, aggregated and non-identifiable

   What its owner says it means

   The homepage says 'No tracking, just pure ad-free browsing.' The FAQ says the data collected is aggregated, non-identifiable information.

   What it does not tell you

   A match with the policy, which describes browsing, search and AI data collected under an identifier it says may be personal information.

6. Label

   Consent prompt

   What its owner says it means

   Two boxes and a required licence tick. Advanced blocking will not activate without acceptance.

   What it does not tell you

   A separate choice about AI chats. Whether this is consent in the UK GDPR sense is a legal test this briefing does not apply.

Label	What its owner says it means	What it does not tell you
Featured	Google's tooltip: 'Follows recommended practices for Chrome extensions.' Its help page says the team checks best practices, user experience and the latest platform APIs, among other things.	That the data collected, or any logic fetched after install, was audited. Neither text says so.
Publisher badge	Tooltip: 'Created by the owner of the listed website. The publisher has a good record with no history of violations.'	Anything about this extension's behaviour. It speaks to the publisher's record.
4.8 from 81.6K ratings	Satisfaction. 2,000,000 users is reach.	What is collected. Ratings of a blocker measure blocking.
Single-purpose Adblock extension	The listing's own phrase.	That every URL must be kept or sent on. The researchers note a blocker has to see URLs to decide what to block, which is different.
Privacy First, aggregated and non-identifiable	The homepage says 'No tracking, just pure ad-free browsing.' The FAQ says the data collected is aggregated, non-identifiable information.	A match with the policy, which describes browsing, search and AI data collected under an identifier it says may be personal information.
Consent prompt	Two boxes and a required licence tick. Advanced blocking will not activate without acceptance.	A separate choice about AI chats. Whether this is consent in the UK GDPR sense is a legal test this briefing does not apply.

A store review that approves a version reviews that version. Google's review guide says submissions are checked for policy compliance and that existing items are also reviewed periodically. What the researchers describe arrives after install, from the vendor's server, outside the package.

What an extension that can read every page can read

Google's own review guide explains why broad host permissions slow a review: patterns that match every site give an extension "extensive access to the user's web activity", and such access can be used to collect browsing history, scrape data from banking sites or harvest credentials. The NCSC's browser guidance puts the same point plainly: "Extensions typically have permissions to read or change the data on any websites a user visits. This could include sensitive or personal data." It uses an ad blocker as its example of a common extension.

An AI chat is a web page. Its text, the box a prompt is typed into and the responses that come back from the service are all things an extension with access to that site can read. No vulnerability is needed; the permission is the capability. The report shows a program for one named service that watches the conversation response from that service's interface and keeps the whole message body. We do not reproduce it.

The report does not print the extension's host permissions. The vendor's FAQ has a question asking why users "need to allow Poper Blocker to read data on websites", and a screenshot in the report of another scanner, Koidex, flags Broad Host Permissions at medium. Your own admin console can show the requested website access for any installed extension, which is a better source than either.

A reviewed package, then programs that arrive afterwards

Google's Manifest V3 rules say the full functionality of an extension "must be easily discernible from its submitted code", and that external resources "must not contain any logic". They name as a common violation "Building an interpreter to run complex commands fetched from a remote source, even if those commands are fetched as data". They allow fetching a remote configuration where all the logic is in the package. The page was last updated on 3 April 2024.

The researchers describe an extension that ships an interpreter and no programs. On startup it asks the vendor's server for a batch of programs and for a numbered dictionary that gives the commands their meaning. Neither is in the package, and they say none of the command names appears in the extension's code, so reading the code does not reveal what it can do. Decoded, the instruction set can read page content, request and response bodies and WebSocket traffic, capture regions of a page as images, compress them, and send the result to an address the server supplies, which it can replace on any reply.

Timing. On a fresh install the researchers' first calls returned nothing of interest, and the programs arrived about 24 hours later. They found no timer in the extension, so the delay is set by the server, and their May post observed the same after letting a user ID age for a day. They note that a review sandbox runs for minutes. They read the delay, a program that checks for automation flags and a second switch that keeps uploads off until a user opts in as ways of passing review. That reading is inference. They saw the delay and the fingerprinting program; they did not see the server treat a reviewer differently, and they say they queried one ID on one day.

Version numbers. The listing shows 8.10.4, updated 21 September 2026. The sample payload in the report shows 8.9.3. Either the capture predates the update or the sample is illustrative; the report does not say which. In both cases the version tells you what shipped in the package. It does not tell you which programs the server is sending today.

Which rules apply. If the extension is Manifest V3, the rules above apply to it. Google's admin documentation says Manifest V2 extensions no longer work from Chrome 139 and load disabled, and the extension is live and in use, so it is probably V3; the report does not state it, and an admin console can show the manifest version of what you have installed.

The data rules. Google's separate Limited Use policy prohibits collecting web browsing activity except to the extent required for a user-facing feature described prominently on the store page and in the product's interface. Its user-data FAQ says ad targeting or other monetisation of that data is not a user-facing feature. The vendor's policy says affiliates may pass browsing data to their customers for market research. Whether that is the same thing is Google's decision, not this briefing's.

Edge. The report says the Edge listing carries the same remote configuration, and notes that Edge is what most managed Windows fleets ship with. We did not test it. At about 12:00 BST on 4 October the Edge Add-ons listing was live under the publisher name Big Star Labs LP, with 46,000+ users, version 8.7.4 and an update date of 7 June 2026.

The record, with dates

The first public finding on this extension is not the researchers'. AdGuard's report of 24 July 2018 listed Poper Blocker, with the same Chrome Web Store ID and 2,280,000+ users, among apps and extensions it said collected browsing history and belonged to a newly registered Delaware company called Big Star Labs. Its update of 25 July 2018 said all the items were no longer available on the Chrome Web Store or Google Play. Its update of 20 August 2018 said most had been reinstated "with seemingly little to no change". The gap from 24 July 2018 to 4 October 2026 is 2,994 days, 8 years and 72 days (derived).

One detail is checkable and not conclusive. The hardcoded identifier that AdGuard decoded from a 2018 request is the same string the researchers' 2026 sample shows. A constant that survives eight years says something about how little of the plumbing changed. It says nothing about what the extension collected in between.

Status and responses as found, with the time each was read. Sources: store listings, vendor pages, Bay Area Labs, Dark Reading.

1. Item

   Chrome listing

   Fixed on the record

   About 11:55 BST, 4 October 2026, and again at 12:14 BST: live, Featured, version 8.10.4, updated 21 September 2026, 2,000,000 users, 4.8 from 81.6K ratings.

   Not stated

   Whether Google has opened a review of it. No public record found.

2. Item

   Report to Google

   Fixed on the record

   The 11 May 2026 post lists the extension as Confirmed. The 28 September report says Google was told in May and 'did nothing'. 11 May to 4 October is 146 days (derived).

   Not stated

   Google's own record of the report. Independent confirmation that it was received.

3. Item

   Google

   Fixed on the record

   No statement found at 12:00 BST on 4 October. Dark Reading says Google did not respond to its request for comment (28 September).

   Not stated

   Whether Google is reviewing, or will act.

4. Item

   Vendor

   Fixed on the record

   Policy text unchanged since the 16 September capture. FAQ still says the data is 'aggregated, non-identifiable'. No statement on the report found on its site. Dark Reading says Big Star Labs had not responded (28 September).

   Not stated

   Any dispute of the findings. Any planned change.

5. Item

   Edge listing

   Fixed on the record

   About 12:00 BST, 4 October 2026: live, 46,000+ users, version 8.7.4, updated 7 June 2026.

   Not stated

   Whether Microsoft has been told or has acted.

6. Item

   Operator

   Fixed on the record

   The policy names Big Star Labs LP as controller. The Edge listing names it as publisher. AdGuard named it in 2018.

   Not stated

   Who owns or runs the server the report names.

Item	Fixed on the record	Not stated
Chrome listing	About 11:55 BST, 4 October 2026, and again at 12:14 BST: live, Featured, version 8.10.4, updated 21 September 2026, 2,000,000 users, 4.8 from 81.6K ratings.	Whether Google has opened a review of it. No public record found.
Report to Google	The 11 May 2026 post lists the extension as Confirmed. The 28 September report says Google was told in May and 'did nothing'. 11 May to 4 October is 146 days (derived).	Google's own record of the report. Independent confirmation that it was received.
Google	No statement found at 12:00 BST on 4 October. Dark Reading says Google did not respond to its request for comment (28 September).	Whether Google is reviewing, or will act.
Vendor	Policy text unchanged since the 16 September capture. FAQ still says the data is 'aggregated, non-identifiable'. No statement on the report found on its site. Dark Reading says Big Star Labs had not responded (28 September).	Any dispute of the findings. Any planned change.
Edge listing	About 12:00 BST, 4 October 2026: live, 46,000+ users, version 8.7.4, updated 7 June 2026.	Whether Microsoft has been told or has acted.
Operator	The policy names Big Star Labs LP as controller. The Edge listing names it as publisher. AdGuard named it in 2018.	Who owns or runs the server the report names.

Why this is a data-protection question for a UK organisation

People paste into AI chats what they would not post on a public page: client details, case notes, HR matters, contract terms, draft board papers, source code. The report's own summary of a work machine is "source code, internal documents pasted in for summarising". An extension with access to the page can read what is on it.

Controller duties. If staff use AI tools on work devices, your organisation is generally the controller of the personal data they put in. The vendor describes itself, in its policy, as a controller of what it collects. On that description it is a separate controller that received your staff's data, not a processor you appointed or have a contract with. That is our reading of the policy and not a legal opinion; your data protection officer should confirm it.

Breach assessment. The ICO defines a personal data breach as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data", and lists "access by an unauthorised third party" among its examples. Whether staff using an extension they chose to install amounts to that is a judgement for your DPO, made on facts: was it on managed profiles, since when, was the data-sharing prompt accepted, did chats contain personal data? If so, the ICO guide says to assess the risk to individuals, to report a notifiable breach within 72 hours of becoming aware of it where feasible, and to keep a record of any breach "regardless of whether you are required to notify". Becoming aware is a fact about your organisation, which is a reason to write down when and how you learned of this.

Confidentiality is wider than personal data. Client confidentiality and trade secrets sit outside UK GDPR, in the same chat window.

The researchers add that conventional data loss prevention would not catch this: a proxy sees the user's own browser posting an encoded blob to an unremarkable domain, with no keyword to match and a destination that can change on the next response. That is their claim, made by a company that sells extension scanning. It is also the reason the controls below sit in the browser and not at the network edge.

Earlier briefings here cover neighbouring ground. Glow found 13,000 public screenshots that AI agents had pushed to public repositories. Gyazo's breach leaked the OCR text inside 490 million screenshots. A chatgpt.com address hosted a lure and proved nothing about the command behind it. In each, a label or a location was treated as a control.

Method and accusation

The researchers use strong words for what they found: malware, a command-and-control channel, a browser extension that spies. Those are their characterisations. The record supports a narrower statement. The vendor's own policy discloses AI data collection and onward sharing. Its listing and marketing say less. And the researchers describe a mechanism, remote programs run by an interpreter inside the extension, that Google's published rules name as a violation.

Two parts of the report are capability and not observation. Screenshotting, full-page capture and file upload are in the instruction set, and the report says the 40 programs it received did not use them. Targeting one organisation is something the mechanism could do; no targeted payload is shown. The observed parts are narrower: programs returned, URLs leaving the browser, and AI chat collection that the May post marks Confirmed.

Bay Area Labs runs a product called Am I Being Pwned, which scans an organisation's extensions, and the report ends by saying only specialised tools that analyse extensions dynamically can catch this. That is a reasonable technical point and also a sales line. The report's screenshot of a rival scanner rating the extension medium risk belongs to the same competitive picture. The researchers' own catalogue page for the extension is labelled "AI-generated. Findings may contain errors", names different hosts from their blog post and prints a sample from a different extension version. This briefing relies on the blog post and takes nothing from the catalogue page. The same report says one in five ad blockers with more than 100,000 users sends some browsing history; the list is not published.

The vendor has a commercial interest of its own, and says so in its policy: the section for US state residents says it sells categories that include internet activity data to affiliates, who may sell on to business customers. The listing declares that data is not sold to third parties outside the approved use cases. Whether affiliates count as third parties for that declaration is not defined in the text we read. The vendor's side, as far as the public record goes: its policy offers an opt-out by unticking "Enable Overlay Blocking" on the options page, and its FAQ says it does not share the data with third parties for marketing or targeting individual users. The researchers' screenshot shows a differently worded control, which they say behaves as an opt-in. We could not test either. No response from the vendor to the report was found.

What to do, in the order worth doing

The IDs below come from the Chrome Web Store and Edge Add-ons listings and the report. A block is a stopgap; the aim is to stop learning about extensions from headlines.

The question the listing cannot answer

An extension inventory records a name, an ID and a version. It records the code that shipped. On the researchers' account, what this extension does is decided by programs the vendor's server sends afterwards, and the server decides where the results go.

If an extension's behaviour can change without a new version, what in your estate would tell you that it had?

Key facts