A fact-based update for security and risk professionals, focused on how AI is reshaping the threat landscape and the defensive stack.

🔐 Core Security Intelligence (AI-Focused)

1) Malicious Chrome extensions caught exfiltrating ChatGPT and DeepSeek chats from ~900,000 users

What’s new
Researchers identified two malicious Chrome Web Store extensions designed to steal ChatGPT and DeepSeek conversation content along with browsing data and exfiltrate it to attacker-controlled infrastructure. The report details how the extensions requested seemingly benign permissions and then harvested conversation data by scraping page elements.

Source:
Two Chrome Extensions Caught Stealing ChatGPT and DeepSeek Chats from 900,000 Users

Why it matters
Browser extensions are a high-trust execution environment that can quietly bypass many enterprise controls. If staff use AI assistants for engineering, support, or incident response work, stolen chats can expose internal URLs, customer data, credentials pasted by mistake, and operational procedures.

How this could be abused
An attacker can collect sensitive prompt/response content (including proprietary code snippets, incident notes, or internal system names) and use it to accelerate targeted phishing, lateral movement, or further credential theft. The same channel can also expose which internal tools and SaaS platforms are in use based on captured URLs and workflows.

Defenses

• Enforce an extension allowlist for managed browsers. Block unknown publishers and require approvals for extensions that can read page content, access all sites, or exfiltrate data. Pair this with periodic audits so “approved” does not become “forever trusted.”
• Treat AI chat data as sensitive telemetry. Update policy and training so employees do not paste secrets, tokens, or internal customer data into assistants. Add technical controls where possible, such as DLP patterns on clipboard or browser upload routes.
• Hunt for extension-driven exfiltration behavior. Monitor for unusual outbound connections, repeated periodic beaconing, and DNS patterns from browsers. Where you have EDR visibility, baseline extension installation events and investigate spikes or new publisher IDs.

Expert insight
This is a practical reminder that AI risk is often a “wrapper risk” around the model: browsers, plugins, and integration points. If the endpoint is compromised, the confidentiality of AI interactions collapses even if the LLM provider is secure.

2) Researchers propose “active data adulteration” to reduce the value of stolen AI knowledge graphs

What’s new
CSO Online covered research proposing an approach that injects plausible false data into a knowledge graph used by an AI system, while authorized users can filter it out using a key. The intent is to make stolen knowledge graphs materially less useful to attackers attempting AI or data theft.

Source:
Automated data poisoning proposed as a solution for AI theft threat

Why it matters
Organizations are increasingly treating proprietary datasets and knowledge graphs as crown-jewel assets that power internal LLM experiences. Defensive techniques that reduce the utility of stolen data can complement classic controls (access management, monitoring, encryption) when exfiltration risk cannot be driven to zero.

How this could be abused
The same concept can backfire if adversaries gain the filtering key, if the adulteration process is misapplied, or if it introduces integrity failures into downstream workflows. In the worst case, defenders could create self-inflicted reliability issues or complicate incident response by obscuring what is “real” in the dataset.

Defenses

• Treat integrity controls as part of the threat model, not an afterthought. If you explore data-adulteration defenses, define how you will validate authorized outputs, detect drift, and prove dataset lineage during incident investigations.
• Prioritize strong access controls and monitoring first. Least privilege, segmentation, and anomaly detection around your knowledge graph remain primary controls. Data-value reduction should be additive, not a substitute for foundational security.
• Pilot in low-risk environments with explicit rollback plans. Use controlled tests, measure latency and accuracy impacts, and ensure you can revert quickly. Document operational ownership so this does not become an orphaned “clever idea” that later causes outages.

Expert insight
Data-value reduction is attractive, but it should be approached like any high-impact control affecting data integrity. If your enterprise relies on AI outputs for decisions, integrity failures can be as damaging as confidentiality losses.

🧭 Adjacent Cybersecurity Developments (Context for AI Risk)

3) AI-powered VS Code forks recommend missing extensions, creating a supply chain risk in Open VSX

What’s new
A report describes how popular VS Code forks, including AI-powered IDEs, recommended extensions that were missing from the Open VSX registry. The gap could allow attackers to publish malicious lookalike extensions under unclaimed namespaces and capture developer trust through “recommended” prompts.

Source:
VS Code Forks Recommend Missing Extensions, Creating Supply Chain Risk in Open VSX

Why it matters
Developer environments often contain high-value secrets, signing keys, source code, and CI/CD tokens. If AI coding assistants and IDE forks amplify extension marketplace risk, attackers can compromise the software supply chain that ultimately supports AI services and data pipelines.

Defenses

• Lock down extension sources and publishers. Require verified publishers and prefer curated internal registries for enterprise use. Treat “recommended” as untrusted input until provenance is confirmed.
• Harden developer endpoints as production-adjacent assets. Apply EDR, restrict admin rights, protect secrets with vault-backed workflows, and monitor for anomalous process and network behavior from IDEs.
• Implement CI/CD guardrails for blast-radius control. Use short-lived tokens, separate build identities, and mandatory code review on pipeline changes so one workstation compromise does not become a pipeline compromise.

Expert insight
As AI-assisted development accelerates, the highest-return attacks target the tooling layer. Extension marketplaces are a persistent weak point, and “AI-powered IDE convenience” can unintentionally raise the success rate of social engineering inside developer workflows.

4) Cyber risk outlook emphasizes resilience as AI-driven threats increase attacker speed and scale

What’s new
SecurityWeek published a cyber risk outlook that highlights a shift toward resilience, citing expanding AI-driven threats and broader risk pressures entering 2026.

Source:
Cyber Risk Trends for 2026: Building Resilience, Not Just Defenses

Why it matters
Whether the initial compromise is AI-assisted or not, AI increases attacker throughput for recon, phishing, and operational iteration. Resilience controls (containment, recovery, verification, and rollback) become critical when adversaries can move faster than human-only response loops.

Defenses

• Operationalize containment and rollback. Build playbooks that isolate systems quickly, revoke tokens at scale, and reverse high-risk changes with minimal downtime. Test these under realistic time pressure.
• Measure recovery for business processes, not just servers. Validate that identity, SaaS access, and data pipelines can be restored cleanly, since AI workloads are typically tightly coupled to these dependencies.
• Instrument your AI and automation layers. Ensure agent tool calls, model endpoint access, and data retrieval logs are available for rapid investigation and post-incident reconstruction.

Expert insight
Resilience is not a soft concept; it is an engineering discipline. AI increases the speed differential between attacker action and defender decision-making, so the organizations that win are those that can contain and recover decisively.

📊 At-a-Glance Summary

Categories: Cybersecurity News

Tags: AI Security, Browser Security, Data Protection, Developer Security, Extension Security, Resilience, Supply Chain