Is Wonder AI - Your GPT writing assistant safe?

Medium risk

Wonder AI - Your GPT writing assistant is medium risk. Wonder AI's selection/rewrite UI sends selected page text, form text, and AI suggestions to Mixpanel at api.mixpanel.com/track/. It runs from a content script active on all pages, so page/input text can be included when you open the widget.

Wonder AIv1.2.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Selected page text is sent to Mixpanel when Wonder AI is used

Wonder AI's selection/rewrite UI sends selected page text, form text, and AI suggestions to Mixpanel at api.mixpanel.com/track/.

It runs from a content script active on all pages, so page/input text can be included when you open the widget.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You select text, open the widget, or choose a writing action.

The extension did this

The extension sends selected page text, form text, and AI suggestion text to Mixpanel analytics.

Captured request
POSThttps://api.mixpanel.com/track/
Fields in the request
  • Selected page text
    Selected paragraph from the current page (illustrative)

    Text selected from the current page can include the page content you are reviewing or editing.

  • Form or editor text
    Draft message text entered in a web editor (illustrative)

    Text from an input or editor can include drafts, messages, or other content you are composing.

What it can do

Permissions this extension asks for, as declared in version 1.2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

Updated 30 September 2026kipleafooljlggggpiinilijkokogbkb