Is Gene — AI Assistant & Smart Search safe?

High risk

Ask Gene sends very large page text to its embedding backend when eligible pages become active.

Ask Gene runs a content script across websites and, on eligible non-PDF, non-Google Docs, and non-YouTube pages, reads the page body text for embedding storage. When the page text is at least 550,000 characters and has not already been cached for that URL, the extension sends the full text to its Google Cloud Run embedding endpoint.

Genev1.2.25Chrome Web Store
72Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Ask Gene uploads full page text once a page tops 550,000 characters

On most web pages, Ask Gene reads the entire visible text and uploads it once a page has over 550,000 characters.

We observed a planted marker leave the device in the request body with no authentication.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You switch to or open a tab showing a normal webpage.

Ask Gene skips PDFs, Google Docs, and YouTube pages, but acts on everything else.

The extension did this

Ask Gene copies the page's entire visible text and, once it is at least 550,000 characters, uploads all of it to its embedding server.

Nothing else about the page, such as its address, is included in this specific upload.

What leaves your device in this upload
  • Full page text
    The complete text of a company wiki page, including any confidential sections (illustrative)

    Every visible word on the page becomes part of the upload, including anything only meant for you: private dashboards, drafts, or messages.

Captured request
POSThttps://embed-secure-510450021786.europe-west1.run.app/storeEmbeddings

A marker planted inside a 600,019-character test page was found intact in this request's fullText field (600,034-byte body), confirming the full page leaves the device. The server returned 200 with no Authorization header required.

Headers
Content-Type
application/json
Where the page text goes
    • embed-secure-510450021786.europe-west1.run.app

    Receives the raw text of qualifying pages and returns an AI embedding vector. Runs on Google Cloud Run under the developer's own project; not a known third-party analytics vendor.

Reproduce it yourself

Paste into the DevTools console on any page to see if its visible text is long enough to trigger Ask Gene's automatic upload.

Requires
  • Chrome DevTools
  • Ask Gene installed and enabled on the page
check_upload_trigger.js · js
const len = (document.body.innerText || '').length;console.log(`Visible text length: ${len} characters`);if (len >= 550000) {  console.log('This page qualifies: switching away from and back to this tab should trigger an upload to Ask Gene\'s embedding server.');} else {  console.log(`This page needs ${550000 - len} more characters of visible text to qualify.`);}
How to run it
  1. 1Open a long page (or one that will grow past 550,000 characters).
  2. 2Open DevTools Console.
  3. 3Paste and run this script.
  4. 4If it says the page qualifies, switch tabs away and back and watch Network for a POST to storeEmbeddings.

Where it sends data

Destinations our analysis observed Gene — AI Assistant & Smart Search contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • embed-secure-510450021786.europe-west1.run.app

    Gene — AI Assistant & Smart Search sends data to embed-secure-510450021786.europe-west1.run.app. No other extension we have analysed sends data here.

Updated 30 September 2026padcpabfckdbahodkfkincpaaeinejik