Is QuestionAI Homework Powered AI Assistant safe?
QuestionAI is high risk. QuestionAI writes a persistent cookie, QUESTION_AI_PCUID, into five sites (google.com, baidu.com, facebook.com, youtube.com, instagram.com), same value each. Expires in ~100 years, not HttpOnly. Lands automatically, no visit needed.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Tracking Cookie Written to Google, Facebook, YouTube, Baidu, Instagram
QuestionAI writes a persistent cookie, QUESTION_AI_PCUID, into five sites (google.com, baidu.com, facebook.com, youtube.com, instagram.com), same value each.
Expires in ~100 years, not HttpOnly.
Lands automatically, no visit needed.
You install QuestionAI and use it once, so it can generate a client ID for itself.
QuestionAI writes that ID as a cookie named QUESTION_AI_PCUID directly into the cookie jars of google.com, baidu.com, facebook.com, youtube.com, and instagram.com.
It also reads the cookie back from any of those five sites and re-writes it to all of them, keeping the same value synced across every site's cookie jar -- you never have to visit any of these sites yourself.
The same tracking ID was found on all five sites named here, confirming it was planted broadly, not scoped to the extension's own domain.
chrome.cookies store, cookie name QUESTION_AI_PCUID{
"www.baidu.com": "rkxhnj0cnutyu6wkual83vkl1jce87_1788084761",
"www.google.com": "rkxhnj0cnutyu6wkual83vkl1jce87_1788084761",
"www.youtube.com": "rkxhnj0cnutyu6wkual83vkl1jce87_1788084761",
"www.facebook.com": "rkxhnj0cnutyu6wkual83vkl1jce87_1788084761",
"www.instagram.com": "rkxhnj0cnutyu6wkual83vkl1jce87_1788084761"
}The code that writes the persistent ID onto five third-party sites' cookie jars.
const TRACKED_SITES = [
"https://www.questionai.com",
"https://passport.questionai.com",
"https://www.google.com",
"https://www.baidu.com",
"https://www.facebook.com",
"https://www.youtube.com",
"https://www.instagram.com",
];
const PCUID_COOKIE_NAME = "QUESTION_AI_PCUID";
// Called whenever the persistent client ID is generated or refreshed
async function persistIdEverywhere(cookieName, value) {
await setLocalStorage(cookieName, value);
for (const siteUrl of TRACKED_SITES) {
await writeCookieOnSite(cookieName, value, siteUrl);
}
}// Writes a cookie directly into the named site's cookie jar via the
// privileged chrome.cookies API -- not marked HttpOnly, expires ~100 years out
function writeCookieOnSite(name, value, url) {
return new Promise((resolve) => {
chrome.cookies.set({
url,
name,
value,
expirationDate: Date.now() / 1000 + 3153600000, // ~100 years
}, resolve);
});
}// Resolves (or mints) the persistent client ID, then fans it out to
// every tracked site's cookie jar -- including reading it back from
// whichever site already has it, if any
async function getPersistentClientId() {
let pcuid = await getLocalStorage(PCUID_COOKIE_NAME);
if (!pcuid) pcuid = await readCookieFromAnyTrackedSite(PCUID_COOKIE_NAME);
if (pcuid) {
persistIdEverywhere(PCUID_COOKIE_NAME, pcuid); // re-syncs it to all sites
return pcuid;
}
const { data } = await api.fetchPost(APIKeys.GET_PCUID, { uuid: await getOrCreateUuid(), cuid: "start" });
persistIdEverywhere(PCUID_COOKIE_NAME, data.cuid);
return data.cuid;
}- www.google.com
Receives the QUESTION_AI_PCUID cookie; readable by any script running on google.com pages since the cookie is not HttpOnly.
- www.baidu.com
Receives the QUESTION_AI_PCUID cookie; readable by any script running on baidu.com pages since the cookie is not HttpOnly.
- www.facebook.com
Receives the QUESTION_AI_PCUID cookie; readable by any script running on facebook.com pages since the cookie is not HttpOnly.
- www.youtube.com
Receives the QUESTION_AI_PCUID cookie; readable by any script running on youtube.com pages since the cookie is not HttpOnly.
- www.instagram.com
Receives the QUESTION_AI_PCUID cookie; readable by any script running on instagram.com pages since the cookie is not HttpOnly.
Checks whether the QUESTION_AI_PCUID tracking cookie is present on the current site. Since the cookie is not HttpOnly, it is readable from any page's own script context via document.cookie.
// questionai-pcuid-cookie-check.js
// Run in the DevTools console on google.com, baidu.com, facebook.com,
// youtube.com, or instagram.com while QuestionAI is installed.
(function () {
const match = document.cookie.split('; ').find((row) => row.startsWith('QUESTION_AI_PCUID='));
if (match) {
console.log('[QAI_PCUID] Tracking cookie found on this site:');
console.log(' ' + match);
console.log(' This cookie was written by the QuestionAI extension, not by this site.');
} else {
console.log('[QAI_PCUID] No QUESTION_AI_PCUID cookie found on this domain right now.');
}
})();- 1Install QuestionAI, let it fully load.
- 2Open google.com, baidu.com, facebook.com, youtube.com, or instagram.com.
- 3Press F12, open Console.
- 4Paste this script, press Enter.
- 5If present, the cookie prints.
Full List of Installed Extensions Sent to studyquicks.com
Every QuestionAI sidebar load asks for the installed-extension list (chrome.management.getAll) and sends it, names, IDs, versions, states, to autotrack.studyquicks.com.
Captured firing twice in one session, no consent prompt or opt-out.
You open the QuestionAI sidebar on any page.
QuestionAI asks the browser for the full list of installed extensions, then sends it (names, IDs, versions, states) to a third-party analytics domain.
This runs on every sidebar mount, is not limited to QuestionAI's own listing, and has no visible opt-out.
name=H60_112&ets=%5B%7B%22name%22%3A%22QuestionAI+Homework+Powered+AI+Assistant%22%2C%22enabled%22%3Atrue%2C%22version%22%3A%222.8.26%22%2C%22id%22%3A%22hajphibbdloomfdkeoejchiikjggnaif%22%7D%5D&isDark=0
| Field | Value | Why it matters | |
|---|---|---|---|
Extension name | QuestionAI Homework Powered AI Assistant | The human-readable name of each extension installed in your browser, sent for every one of them. | |
Extension ID | hajphibbdloomfdkeoejchiikjggnaif | The Store ID of each installed extension, letting the analytics service profile your browser's exact extension toolset. | |
Extension version | 2.8.26 | The installed version number of each extension. | |
Enabled state | true | Whether each extension is currently turned on or off in your browser. |
The code that retrieves and transmits your full extension inventory.
// sidebar.js -- runs when the sidebar content script mounts
sendToBackground({ messageType: "getExtensionsInfo" }, (allExtensions) => {
if (Array.isArray(allExtensions) && allExtensions.length) {
const inventory = allExtensions.map((ext) => ({
name: ext?.name,
enabled: ext?.enabled,
version: ext?.version,
id: ext?.id,
}));
addZSEvent("H60_112", {
ets: JSON.stringify(inventory), // full extension inventory, unfiltered
isDark: prefersDarkMode ? 1 : 0,
});
}
});// background.js -- service worker message handler
case "getExtensionsInfo":
chrome.management.getAll((allExtensions) => {
sendResponse(allExtensions); // every installed/enabled extension and app, not just this one
});
return true;- autotrack.studyquicks.com
Analytics beacon endpoint (bundled third-party client, zpID 'OB-MATH-PCW') that receives the full list of your browser's installed extensions on every QuestionAI sidebar mount.
Hooks fetch() and XMLHttpRequest to detect and print the extension-inventory beacon QuestionAI sends to autotrack.studyquicks.com, decoding the ets field so you can see exactly which of your extensions were included.
// questionai-extlist-monitor.js
// Run in the DevTools console on any page with QuestionAI active.
(function () {
function inspect(label, url, body) {
if (!url || !url.includes('log/math_h5')) return;
console.log('[QAI_EXTLIST] ' + label + ' intercepted:', url);
const params = new URLSearchParams(body || '');
const ets = params.get('ets');
if (ets) {
try {
console.log(' extensions reported:', JSON.parse(decodeURIComponent(ets)));
} catch (e) {
console.log(' raw ets value:', ets);
}
}
}
const origFetch = window.fetch;
window.fetch = function (input, init) {
const url = typeof input === 'string' ? input : input instanceof Request ? input.url : String(input);
inspect('fetch', url, init && init.body);
return origFetch.apply(this, arguments);
};
const origSend = XMLHttpRequest.prototype.send;
const origOpen = XMLHttpRequest.prototype.open;
XMLHttpRequest.prototype.open = function (method, url) {
this._qaiUrl = url;
return origOpen.apply(this, arguments);
};
XMLHttpRequest.prototype.send = function (body) {
inspect('XHR', this._qaiUrl, body);
return origSend.apply(this, arguments);
};
console.log('[QAI_EXTLIST_MONITOR] installed. Open or reopen the QuestionAI sidebar to trigger the beacon.');
})();- 1Install QuestionAI with one other extension.
- 2Open a page, press F
- 31
- 4
- 5Console tab, paste this script, press Enter.
- 6Open (or reopen) the sidebar.
- 7Watch for a [QAI_EXTLIST] entry showing your list sent.