Phia, the buzzy AI shopping tool, was pulling far more user data than disclosed, security researchers say | Fortune

"In a previous version of the browser extension, researchers found that a snapshot of every web page a user of visited-including sites containing highly sensitive information such as bank statements and private emails-was transmitted back to Phia's servers, even when users were not interacting with e-commerce sites."

"The AI shopping startup is fresh off an $8 million seed round led by Silicon Valley venture capital firm Kleiner Perkins, with participation from high-profile investors including Hailey Bieber, Kris Jenner, and Sheryl Sandberg. In October, Phia was named one of TIME's Best Inventions of 2025. Launched in April, the New York-based startup has since grown rapidly, reaching hundreds of thousands of users between the app and desktop browser extension."

"Maahir Sharma, an ex- Meta software engineer based in Dublin, was the first to notice privacy issues with the AI browser extension. "I began by testing it on Amazon," he told Fortune. "But what really caught my attention was the number of requests being sent, transmitting product page details back to their servers." Transmitting retail site data for comparison and other AI-driven features was somewhat expected, he said, but after he noticed the same network calls were happening in the background while checking his Gmail, he was alarmed."

Four cybersecurity researchers found that a prior version of the Phia browser extension transmitted snapshots of every visited web page to company servers, including pages with bank statements and private emails. Network analysis showed the extension logged URLs and sent product-page details and other data even when users were not interacting with e-commerce sites. An ex-Meta engineer first noticed unexpected background requests while checking Gmail and concluded complete browsing histories could be reconstructed. The startup raised an $8 million seed round, attracted high-profile investors, earned a TIME recognition, and rapidly grew to hundreds of thousands of users.

Read at Fortune