More from the article ...

... Lee S Dryburgh, an expert in AI visibility for consumer health and longevity brands, explained how this works in a report provided to The Register.

People install browser extensions that purport to offer free VPN service or ad blocking or some other capability, likely without reading or understanding the extension's privacy policy.

These extensions may silently intercept users' communications with AI services like ChatGPT, Gemini, Claude, and DeepSeek. They can do so by overriding the browser's native fetch() and XMLHttpRequest() functions in order to capture every prompt and every response.

"This data is captured from real people's private AI conversations via browser extensions, stored in a vector database, and exposed via API to authenticated customers," said Dryburgh in his report.

"The panelists have pseudonymized IDs (SHA-256 hashes) but the content of their conversations is stored verbatim and searchable -- and many prompts contain real names, dates of birth, medical record numbers, and diagnosis codes." ...