Is YouTube Summary with AI safe?

Medium risk

Youtube Summary With AI sends page URLs and video metadata to PostHog analytics when users trigger AI features.

When a user requests a YouTube video summary, the extension captures the current page URL and video metadata and transmits them to PostHog via a hardcoded project key. Additionally, JavaScript errors occurring on supported AI chat sites (ChatGPT, Claude, Gemini, Grok, Mistral) also send the page URL and error details to the same PostHog endpoint. Both flows use a persistent random client ID stored locally to identify the user across sessions.

Dictanotev1.35Chrome Web Store
45Risk
Who publishes it

Dictanote - 4 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Dictanote

Same store account

4 other listings published from this account, 801k+ users between them. 1 of them carries a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

YouTube page details sent to PostHog when you summarize a video

MediumunwantedCWE-359Dynamic sandbox

When you summarize a YouTube video, the extension sends analytics data to PostHog at app.posthog.com/batch/.

What actually happens

You did this

You click or use a hotkey to summarize a YouTube video.

The extension did this

The extension sends the current YouTube page URL and page title to PostHog analytics.

Captured request

POSTapp.posthog.com/batch/

Fields in the request

  • Your YouTube page URL
    https://www.youtube.com/watch?v=dQw4w9WgXcQ (illustrative)

    Shows the exact YouTube page open when you use the summarize feature.

  • Page title
    How to repair a bicycle (illustrative)

    Describes the video page associated with the summarize action.

Where it sends data

Destinations our analysis observed YouTube Summary with AI contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • app.posthog.com

    YouTube Summary with AI sends data to app.posthog.com. 6 other extensions we have analyzed send data here.

Updated 22 October 2026leidjgpcaiceoeebkdjfcaeboidcjiea