What Is Prompt Poaching And How Companies, Browser Stores, And Users Should Protect Themselves
By M. Crawley
Prompt poaching is a new threat where browser extensions take your conversations with AI and send them to external servers.
What Is Prompt Poaching?
Prompt poaching is the practice of browser extensions capturing conversations between users and AI chatbots like ChatGPT, Claude, DeepSeek, and Perplexity, then sending this data to remote servers. Both malicious extensions and legitimate extensions with millions of users do this.
The captured data includes complete conversation created from prompts and responses.
How Prompt Poaching Operates
These extensions request permissions for analytics or user experience improvements, and will monitor your browser and capture chat content as it happens.
They hook into browser functions and intercept conversation data directly from the page. That data gets packaged and sent to external servers over encrypted connections, so it looks like normal web traffic and can't be detected through standard monitoring.
Users grant these permissions during installation unsuspectingly and the extensions frame their data collection as anonymous analytics, but what they actually capture goes beyond what most users expect when clicking "Allow."
The Scope of the Issue
It was found that around 900,000 Chrome users were potentially impacted by two malicious extensions posing a legitimate browser tool. Both extensions had were featured in the Chrome Web Store, which made them appear even more trustworthy to users.
Researchers also found that more established extensions with millions of downloads participate in prompt poaching. These are recognized extensions that users have trusted and relied on for many years. Some started conversation monitoring in 2025 and didn't disclose it clearly until after updating their privacy policies in early 2026.
For casual user, this is a privacy issue. The questions and conversations with AI tools are collected without understanding how that data will be used. For organizations, the risk is much higher. Employees using AI chatbots for work may unintentionally expose proprietary code, business strategies, client information, or confidential research through these extensions.
Why This Practice Persists
Some extensions operate maliciously by hiding their data collection practices behind vague permission requests and they get removed once discovered. However, new ones emerge regularly, which can be difficult to catch when employing new tactics.
Other extensions take a legal approach when they update their terms of service to disclose that they collect AI conversation data. The disclosure language is usually vague or may be buried in privacy policies that most users never read. Someone installing an extension that promises to "enhance" their ChatGPT experience is unlikely to review whether "analytics collection" includes their entire conversation history.
The permissions model doesn't necessarily make clear what "access to website data" actually means, so an extension asking for permission to read and modify website content might actually need that for legitimate functionality, or it might use that access to scrape your AI conversations. During installation, both of those scenarios look identical to users.
Extensions can also update their behavior after approval. Unless users are actively looking for changes in data handling practices, they probably won't notice when an extension they've trusted for months when it starts capturing new types of data.
Mitigation Considerations
Platform Level
Browser extension marketplaces need stricter review processes for extensions requesting invasive permissions. The approval process for tools that can access all website data should consist of more rigorous testing and require clearer disclosure about data handling.
The Chrome Web Store, Firefox Add-ons, and Edge Add-ons handle extension reviews differently, so naturally this creates consistency gaps.
Organizational Level
Organizations can use application whitelisting to prevent employees from installing unknown extensions. This would require a formal request process where the technical team can test these extensions in an isolated environment before approval for use.
If this approach is too restrictive, companies can take the route of updating their acceptable use policies to address AI tool usage. The policy should clarify that while chatbots may be approved for work, sharing company information like client data, proprietary code, or business strategies violates the policy. Many organizations are adding this guidance to security awareness training as AI tools become more popular in workflows.
Technical controls and policy frameworks work best together. Employees need to understand why these restrictions exist.
Individual Level
Individual users lack the resources that organizations have so they need a more proactive approach.
These users should start by taking stock of installed extensions and remove anything without a clear and specific use. If you can't immediately say why an extension is installed and its value to you then remove it. Check the permissions each extension has and consider whether those permissions match with its intended functionality.
Users may also disable all extensions when using AI chatbots. This could mean opening a new browser window or using a separate browser profile for AI interactions. This would eliminate the risk of capturing conversations but requires an adjustment to your workflow.
Looking Forward
Prompt poaching will continue to evolve as AI tools become more integrated into the daily workflows of users. This type of practice is easy to implement, difficult to detect, and profitable for those collecting the data.
As AI chatbots become standard tools for learning, research, and professional work, the security considerations around their use should see a similar growth spike. Regulations are catching up slowly but the technology adoption is moving faster than policy implementation, so until more comprehensive frameworks are in place, users and organizations will bear the responsibility for managing this risk through informed decisions about the tools they use and the permissions they grant.