**AI Hallucinations Trigger Malware Flag on 1M+ Active User Extension**

> 群组 群组 会话 所有群组和帖子 发送反馈给 Google 帮助 培训 登录 群组 群组 Chromium Extensions 会话 关于 隐私权 • 条款 &\#xE5C4; &\#xE899; &\#xE408; &\#xE409; AI Scanner Hallucinations Trigger Malware Flag on 1M+ Active User Extension 已查看 39 次 跳至第一个未读帖子 &\#xE946; Mixe 未读， 19:18 (4小时前) 19:18 &\#xE83A; &\#xE15F; &\#xE5D4; 回复作者 登录即可回复作者 转发 登录即可转发 删除 您无权在此群组中删除帖子 复制链接 举报消息 显示原始帖子 要么此群组的电子邮件地址为匿名状态，要么您得查看成员电子邮件地址权限才能查看原始帖子 收件人 Chromium Extensions Hi everyone, I wanted to share a technical case study regarding a recent false-positive malware enforcement event affecting our extension, Magic Actions for YouTube (~1M users, active for 15+ years). We recently uncovered a specific mechanism behind how automated extension flags can trigger a client-side desync between Chrome and Google's backend security status. I'm sharing this here to start a discussion on how the developer community and Chrome extension team can better handle third-party AI hallucinations. 1. The Anomaly (Backend vs. Client-Side Desync) Search Console and Google Safe Browsing reporting "No issues detected" (100% clean status) for crx. Chrome at chrome://extensions page suddenly flagged the installed CRX package as "This extension contains malware" and force-disabled it for all users. CRX Hash: df9a8a4ea4f83d656fd94898011ebb3e75f8be400a439fcbb75c013a02034f22 (100% identical binary to the CWS build , manually approved! by CWS team. 2. Root Cause: AI Scanner Hallucination? When investigating the CRX binary across security engines, traditional AV vendors (Kaspersky, Defender, Bitdefender, Symantec, etc. 60+engines) returned clean detections. However, a single crowdsourced AI vendor on VirusTotal (ExodiaLabs) flagged the file with a summary: "creates context‑menu entries linking to the developer's site, and periodically sends a generated anonymous user ID and usage telemetry to https://api64.com etc. This analysis is factually false. The static LLM engine hallucinated benign browser API calls into a dramatic security threat description. 3. The Negative Feedback Loop Because Google Safe Browsing ingests crowdsourced threat data from VirusTotal, this single AI hallucination appears to have triggered automated client-side enforcement? 1. AI engine generates hallucinated code summary on VirusTotal. 2. Automated Safe Browsing telemetry ingests the vendor flag. 3. Chrome applies a client-side block on local extensions and CWS put entire account into "Malware Creator"! Then anotherextensions automatically Taken Down also! 4. Users panic at the warning and uninstall the extension, which automated classifiers can misinterpret as user confirmation of a threat. Questions for the Community & CWS Team: 1. Safe Browsing Telemetry Sync: Has anyone else experienced client-side extension blocks where Search Console reports clean, but Safe Browsing flags the extension in the chrome://extenions ? 2. AI Hallucination Safeguards: As more AI static analyzers join VirusTotal and automated security pipelines, what safeguards or human-in-the-loop verifications should be required before client-side enforcement is triggered? We have filed a report on the Chromium Issue Tracker also: https://issues.chromium.org/issues/560237026 Plus disputed the vendor flag directly, but we would love to hear feedback from other extension developers facing similar AI destructions. Best regards, Developer Team, Magic Actions for YouTube https://www.chromeactions.com Mixe 未读， 23:00 (11分钟前) 23:00 &\#xE83A; &\#xE15F; &\#xE5D4; 回复作者 登录即可回复作者 转发 登录即可转发 删除 您无权在此群组中删除帖子 复制链接 举报消息 显示原始帖子 要么此群组的电子邮件地址为匿名状态，要么您得查看成员电子邮件地址权限才能查看原始帖子 收件人 Chromium Extensions、Mixe The key element is ExodiaLab , which leverages its AI hallucinations , just look at what their AI says about the CRX file manually approved by the CWS te...

**来源信息**
- **来源**：Hacker News：AI 热帖
- **分类**：行业
- **发布时间**：2026-09-12 11:10（北京时间）
- **原文**：[打开原文](https://groups.google.com/a/chromium.org/g/chromium-extensions/c/dG_VSqyli1A)