Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Why are people looking for Urban VPN alternatives? In December 2025, the security firm Koi Security reported that Urban VPN Proxy, a free Chrome and Edge extension with over 6 million users and a Chrome ‘Featured’ badge, had been capturing users’ conversations with eight AI chatbots, including ChatGPT, Claude and Gemini, Dark Reading and Infosecurity Magazine reported. The capture reportedly began with version 5.5.0, released on 9 July 2025, ran whether or not you had the VPN switched on, and sent the data towards BiScience, a data broker affiliated with the extension’s publisher.
This page summarises the findings, what to do if you used it, and safer alternatives.
What Koi Security Reported
| Finding | Detail | Source |
|---|---|---|
| When it started | Version 5.5.0, 9 July 2025 | Infosecurity Magazine |
| What was captured | Prompts and replies from 8 AI chatbots | Dark Reading |
| VPN on or off | Capture ran either way | Infosecurity Magazine |
| Scale | About 8 million users across related extensions | BankInfoSecurity |
| Where data went | Towards BiScience, a data broker | Moonlock, Malwarebytes |
| How to stop it | Uninstall the extension | Dark Reading |
The privacy policy disclosed it, which is why reading a policy matters before choosing Urban VPN alternatives too. Urban VPN’s policy, dated 25 June 2025, says the extensions collect AI chat data, Moonlock found, while the Chrome listing said data wasn’t sold outside approved uses, Dark Reading noted. Its ‘AI protection’ feature didn’t stop the collection, Infosecurity Magazine reports.
If You Used Urban VPN
| Step | What to do |
|---|---|
| 1 | Remove Urban VPN and any related extension from every browser |
| 2 | Assume AI chats after 9 July 2025 may have been captured |
| 3 | Rotate any passwords, keys or codes you pasted into AI chats |
| 4 | Tell your employer if you shared work data |
| 5 | Review your remaining extensions and their permissions |
Koi’s own advice was blunt: anyone who used the targeted chatbots with Urban VPN installed after 9 July 2025 should assume those conversations reached Urban VPN’s servers and third parties, Infosecurity Magazine quotes. Our Chrome extension guide shows where to remove extensions; our guide to what a VPN hides explains why a VPN never protected those chats from the extension itself.
Businesses face the bigger risk. Staff pasting code or customer details into AI tools created an exfiltration channel outside normal security controls, CSO Online warns. Our workplace VPN guide covers what employers can see.
Urban VPN Alternatives: The Picks
| Option | Cost | Why |
|---|---|---|
| Proton VPN free | Free, no data cap | Audited no-logs policy; an app, not an extension |
| NordVPN | Paid | Audited; covers every app |
| Surfshark | Paid | Unlimited devices |
| Opera or Edge built-in VPN | Free | Browser-level, from the browser maker |
Among Urban VPN alternatives, prefer an app to an extension. A browser extension can read and change the pages you visit, which is exactly how the capture worked. A device VPN app from an audited provider doesn’t need that access, as our audit tracker helps you check. Our Proton VPN value guide covers the free option.
Surfshark and NordVPN share a parent, Nord Security. Our free VPN guide explains how free VPNs make money, and our Hola guide covers another free model with a catch.
How We Research
The findings come from Koi Security’s research as reported by Dark Reading, Infosecurity Magazine, BankInfoSecurity, Malwarebytes, Moonlock and CSO Online between December 2025 and July 2026. We have not independently tested the extension. Infosecurity Magazine’s summary is here. We read all sources on 28 September 2026. Proton and NordVPN are providers we link to. Our full approach lives on the About Us page.
Urban VPN Alternatives FAQ
Koi Security reported that from July 2025 the extension captured prompts and replies from eight AI chatbots and sent them towards a data broker, BiScience.
According to Koi’s findings, yes: the capture ran whether or not you had the VPN switched on.
Uninstall the extension. Koi said removal is what stops it.
Proton VPN’s free plan, a device app with no data cap and an audited no-logs policy.
Extensions can read the pages you visit, so choose ones from audited providers or browser makers, and review permissions.
The Verdict
Urban VPN alternatives are the obvious move after Koi’s findings: the extension reportedly captured AI chats even with the VPN off.
Uninstall it, treat AI chats since July 2025 as exposed, and switch to an audited VPN app rather than another free extension.