Decryption analyst reveals big news: Kaito AI’s browser plugin Kaito Pulse launched yesterday reportedly performs multiple in-depth data collection behaviors, raising privacy concerns.
According to analysis, the plugin uses hash calculations to identify a user’s GPU rendering, hardware models, and hardware test audio, then ties this unique combination to the user’s X account, enabling cross-platform identity tracking.
In terms of browsing behavior monitoring, it can capture the user’s complete browsing history, feed hover time, clicks, and follow status. It also sends heartbeat packets with active detection on a 30-second cycle, continuously tracking the user’s online status.
More notably, the tool can read Claude and ChatGPT subscription plans and the proportion of quota consumption, and even automatically click into the Usage page in ChatGPT. On Binance, it automatically accesses the Positions tab, re-sends authenticated requests to read wallet balances, futures positions, profit and loss, and deposit/withdrawal history.
With overly broad browser plugin permissions and unclear boundaries for user data collection, we’re reminded again: before installing any Web3 tool, carefully review its permission scope, and protect both your on-chain assets and your personal privacy. #Kaito#Web3 Security#Privacy Protection
According to analysis, the plugin uses hash calculations to identify a user’s GPU rendering, hardware models, and hardware test audio, then ties this unique combination to the user’s X account, enabling cross-platform identity tracking.
In terms of browsing behavior monitoring, it can capture the user’s complete browsing history, feed hover time, clicks, and follow status. It also sends heartbeat packets with active detection on a 30-second cycle, continuously tracking the user’s online status.
More notably, the tool can read Claude and ChatGPT subscription plans and the proportion of quota consumption, and even automatically click into the Usage page in ChatGPT. On Binance, it automatically accesses the Positions tab, re-sends authenticated requests to read wallet balances, futures positions, profit and loss, and deposit/withdrawal history.
With overly broad browser plugin permissions and unclear boundaries for user data collection, we’re reminded again: before installing any Web3 tool, carefully review its permission scope, and protect both your on-chain assets and your personal privacy. #Kaito#Web3 Security#Privacy Protection