Chrome Web StoreCaution required
Suspicious in code review (v1.0.3)
Our reviewer found behaviour consistent with malware in version 1.0.3, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
Ask GPT, used by 2,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (2 high), led by other. It comes from a trusted publisher and was last updated in October 2026.
Key findings
- High
Other
A live OpenAI API key is hardcoded verbatim in the extension source. Any user who installs the extension — or inspects the downloaded CRX — can extract this key and use it freely against the developer's account with no rate limiting or attribution. The description's "No sign up required" confirms this is intentional, but the credential is fully extractable and abusable outside the extension's popup context.
- High
Other
The bundled declares no `permissions` array, while the published CWS listing shows `permissions: ["contextMenus", "storage"]`. This mismatch means the extension was reviewed by Google with one permission set but ships a different manifest in the ZIP. The code uses `localStorage` (no permission needed) and `chrome.tabs.create` (also no permission in MV3), so the declared `contextMenus` and `storage` permissions may reflect a prior or planned version — but the discrepancy between the reviewed and distributed manifest is itself a trust signal.
Analyst notes
The extension's core logic is straightforward and matches its stated purpose — it POSTs user questions to [domain withheld] and stores results in localStorage. However, two concrete issues require elevation to suspicious: (1) a real OpenAI API key is hardcoded in:22 (`sk- `), exposing the developer's credential to all 2,000 users who can trivially extract and abuse it outside the extension; and (2) the bundled declares zero permissions while the published CWS listing shows `contextMenus` and `storage`, a direct manifest mismatch. The third-party score (Impact) and our risk engine (0.00) both corroborate a functionally benign payload, but the publisher's 50% malicious rate across other extensions and the manifest discrepancy prevent a benign verdict.
Ask GPT Chrome extension security report
ID: ihenjheffdoojicaemilfcdcjglimpme
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- J
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- 1122 W 6th St Los Angeles, CA 90017 US
Screenshots & videos
Install growth
About this extension
Empowering users with AI, this extension can swiftly produce answers, replies, and essays about any topic.
Read the publisher’s full description
No sign up required! Users can have immediate access the power of this advanced natural language processing technology to obtain accurate and comprehensive answers to their queries. This chrome extension is designed to provide users with the ability to ask questions and receive answers quickly and easily using ChatGPT's API. Whether you need help with research, want to learn more about a topic, or simply want to satisfy your curiosity, this extension can help you get the answers you need in a matter of seconds. It is easy to use and intuitive, making it a great tool for anyone who needs to access information quickly and efficiently. Overall, this extension is a valuable tool for anyone who needs fast, accurate answers to their questions. Whether you're a student, a researcher, or just someone who wants to learn more about the world around them, this extension can help you access the information you need quickly and easily.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from J
- Comic-Sansify66 users
- Pom9 users
- DriftGuard9 users
- yeppp appp1 users
- yeppp appp1 users
Popular in Tools
- 迅雷下载支持85,000,000 users
- Zotero Connector9,000,000 users
- ChatGPT8,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users
- WPS PDF - Read, Edit, Fill, Convert, and AI Chat PDF with Ease7,000,000 users
Store rankings
Where this extension appears in store category, collection and keyword rankings.