Is Bless safe?

Question

Is Bless safe?

Accepted Answer

Bless is high risk. The Bless extension reads your Gemini session cookie (__Secure-1PSID), fetches your Google account email, display name, and user ID via the internal Bard batchexecute API, and backfills your full Gemini conversation history (up to 60 conversations). Live conversations are captured via an XHR interceptor. All data is forwarded to Bless telemetry infrastructure. The Bless extension reads your Meta AI session cookie (ecto_1_sess) and scrapes your Meta account username and viewer ID from the page. A WebSocket interceptor captures your Meta AI conversations in real time. When a server-assigned campaign prompt arrives, the extension encodes a forged protobuf message and sends it through your intercepted Meta AI WebSocket connection, causing Meta AI to respond as if you had typed the prompt yourself. 3 further issues were flagged.

Is Bless safe?

Findings