ModHeader Extension Yanked After Dormant Data Collector Found

Google and Microsoft have both pulled the popular ModHeader extension pulled from their official stores. The header-editing tool, which had roughly 1.6 million installs across Google Chrome and Microsoft Edge, was removed after security researchers uncovered a hidden browsing-history collector buried in its code.

The collector was dormant. An empty allow-list kept it switched off, and no proof has emerged that it ever gathered or sent a single browsing domain. But its mere presence was enough to trigger a takedown from both companies.

What ModHeader Did — and What Got Hidden Inside

ModHeader let developers and power users modify HTTP request headers on the fly. It was a niche but essential tool for testing web apps, debugging APIs, and spoofing headers for development work. Many users installed it years ago and never thought twice about it.

Then researchers at BleepingComputer took a closer look at the extension’s code. They found a function that could collect domains from a user’s browsing history and send them to a remote server. The collector was gated by an allow-list — a list of domains it would actually track. That list was empty.

Empty or not, the code was there. And once you ship code that can exfiltrate data, the damage to trust is done.

1.6 Million Installs — But No Evidence of Data Theft

Here’s the tricky part. The collector was never active. No domains were ever sent. The extension’s developer likely inserted the code as a placeholder for future functionality — or maybe as a test that got accidentally pushed to the store. Either way, it violated each store’s policies against unauthorized data collection.

Google’s Chrome Web Store policy is clear: extensions must only request permissions they actually use. Code that could collect browsing history, even if dormant, is a red flag. Microsoft’s Microsoft Edge Add-ons policy is similarly strict.

Both companies acted fast. The extension was removed within days of the report. Users who already have ModHeader installed can still use it, but it won’t receive updates. And it won’t be available for new installs.

What This Means for Extension Developers

This incident is a sharp reminder: if you include code that can collect user data — even if it’s switched off — you’re playing with fire. Store reviewers are getting better at spotting suspicious patterns. And researchers are constantly scanning popular extensions for hidden functionality.

For users, the lesson is simpler. ModHeader extension pulled from stores doesn’t mean it’s safe to keep using. If you have it installed, consider whether you trust the developer to never flip that switch. Many users are already looking for alternatives like Requestly or Header Editor.

• Check your installed extensions regularly.
• Remove anything you don’t actively use.
• Stick to well-known developers with transparent privacy policies.

Alternatives to ModHeader

If you relied on ModHeader for development work, you’re not stranded. Several alternatives offer similar header-editing capabilities:

• Requestly — open-source, actively maintained, with a clear privacy policy.
• Header Editor — lightweight and focused on modifying request and response headers.
• Modify Headers — another solid option for HTTP header manipulation.

Each of these tools has been vetted by the community. None have hidden data collectors — at least, not yet. That’s the uncomfortable truth about browser extensions: you’re trusting the developer every time you click “Add to Chrome.”

The Bigger Picture: Trust in Browser Extensions

The ModHeader case isn’t an isolated incident. In 2023, Google removed dozens of extensions caught stealing user data. In 2024, a popular ad-blocker was found to be quietly sending browsing data to a marketing firm. The pattern keeps repeating.

Browser extensions are powerful. They can see everything you do — every page you visit, every form you fill, every password you type. That power makes them a prime target for bad actors. And even well-intentioned developers can make mistakes that compromise user privacy.

The ModHeader extension pulled story is a cautionary tale. It shows how quickly trust can evaporate. And it underscores why you should treat every extension as a potential risk — even one with 1.6 million installs and years of good reputation.

For now, the collector remains dormant. But the code is still there. And that’s enough to make anyone think twice.

The 844 MB Wake-Up Call

On May 15, 2026, security firm GitGuardian spotted something alarming: a public GitHub repository named “Private CISA” containing 844 MB of sensitive data from the Cybersecurity and Infrastructure Security Agency (CISA). Inside sat files like “importantAWStokens” — administrative credentials to three AWS GovCloud servers — and a CSV listing plaintext usernames and passwords for dozens of internal CISA systems.

The repository had been public for nearly six months before KrebsOnSecurity alerted the agency. CISA’s own postmortem, published by acting CIO Preston Werntz and acting CISO Brad Libbey, doesn’t sugarcoat what went wrong. It’s a rare, transparent look at how a national cybersecurity agency fumbled its own security — and what every organization can learn from the mess.

Key Rotation Took Too Long

CISA acknowledged the alert quickly, but invalidating the exposed AWS keys and other secrets took more than 48 hours. The agency blamed the delay on “complexities of the agency’s systems and interconnections with federal and industry partners.”

The lesson is blunt: key rotation must be fast and well-practiced. CISA now recommends that all organizations maintain “mature and well-tested key management capabilities.” If rotating a compromised credential takes two days, an attacker has a wide window to cause damage.

Why Speed Matters

Every hour a credential stays live increases risk. The postmortem doesn’t say whether the exposed keys were used maliciously, but it does confirm that detailed logs showed no unauthorized access. That’s lucky — not a strategy.

Nine Ignored Alerts, Six Months of Exposure

Guillaume Valadon, the GitGuardian researcher who first contacted KrebsOnSecurity, revealed a damning detail: CISA had received nine automated alerts about the exposed credentials before the May 15 notification. Each alert went unanswered.

“Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure,” Valadon wrote in his own analysis. His point is sharp: automated scanning is useless if nobody reads the reports.

Organizations should configure alerts to escalate if ignored. A single unread email shouldn’t leave sensitive data exposed for half a year.

Reporting Channels Were a Maze

When Valadon tried to report the leak, he hit dead ends. CISA’s vulnerability disclosure platform was designed for product bugs, not reports about the agency’s own infrastructure. He ended up emailing the contractor who leaked the data, submitting through the wrong channel, and eventually going to a reporter.

The postmortem admits these channels “were not well defined.” CISA is now refining them to make reporting faster and easier. The agency also stresses that organizations should publish reporting instructions in multiple prominent locations — not just a security.txt file.

Valadon’s advice: “Make it trivial to report a leak about you, not just about your products. The person reporting a leak to you is not the threat.”

The Playbook Didn’t Cover GitHub

CISA had an incident response playbook, but it somehow didn’t include scenarios involving GitHub or other cloud services. That gap meant the team had to improvise when dealing with a public repository full of their own secrets.

The lesson is straightforward: incident response playbooks must cover modern attack surfaces. Cloud repositories, CI/CD pipelines, and third-party integrations all need dedicated procedures. If your playbook only covers traditional network intrusions, you’re not ready for today’s threats.

Continuous Scanning Is Non-Negotiable

The “Private CISA” repository sat exposed for six months. GitGuardian found it through continuous monitoring of public GitHub — not a quarterly scan. Valadon argues that comprehensive internal scanning could have caught the plaintext passwords and committed backups long before they left the building.

CISA has since rotated all secrets and created an action plan to improve developer secret management and monitoring. The agency now advocates for continuous secrets scanning, a practice Valadon calls “exactly the incident communication we should expect from every organization.”

What Went Right: Logging and Zero Trust

CISA gave itself passing grades on several fronts. Enhanced logging capabilities allowed the agency to gauge the scope and impact of the exposure. Adoption of zero-trust principles in both production and development systems meant that even though credentials leaked, they couldn’t be used outside CISA’s environments.

The agency confirmed that no customer or mission data was exposed, and the contractor who leaked the secrets had their system access revoked. These controls prevented a bad situation from becoming catastrophic.

The Biggest Takeaway: Transparency

Valadon praised CISA for publishing the postmortem at all. “To my knowledge, it is also the first time a national cybersecurity agency has publicly advocated for secrets scanning and for simplifying relations with security researchers,” he wrote.

That’s the real lesson. A detailed, honest post-incident report — one that admits mistakes and offers concrete fixes — builds trust. It also helps the entire security community improve. Every organization should aim for that level of candor.

For more on securing your development workflows, check out our guide on GitHub secrets scanning best practices and learn how to set up automated credential monitoring.

Inside the CISA-Anthropic Partnership

The US Cybersecurity and Infrastructure Security Agency (CISA) is reportedly deploying a specialized AI tool from Anthropic to probe federal software for vulnerabilities. Sources familiar with the arrangement say the system, called Mythos, is being used by CISA’s Attack Surface Evaluation team — a unit dedicated to simulated hacking and digital defense assessments.

This isn’t some generic chatbot. Mythos is purpose-built for code analysis. It scans source code, configuration files, and even running applications to flag weaknesses that human reviewers might miss. Think of it as a tireless, AI-powered penetration tester that never sleeps.

What Exactly Is Mythos?

Anthropic has kept details about Mythos under wraps. But what’s known is that it’s a large language model (LLM) fine-tuned specifically for cybersecurity tasks. Unlike Anthropic’s consumer-facing Claude chatbot, Mythos is designed to understand software architecture, identify insecure coding patterns, and suggest fixes.

It’s reportedly been in development for months, with CISA providing feedback to sharpen its detection capabilities. The tool can process massive codebases quickly — something that would take a team of human analysts weeks or months to review manually.

How It Differs from Traditional Scanners

Conventional vulnerability scanners rely on known signatures and rule-based checks. They’re good at catching known issues but struggle with novel or context-dependent flaws. Mythos, by contrast, uses reasoning. It can infer that a particular sequence of operations might lead to a security hole, even if no exact pattern exists in its training data.

That’s a significant leap. It means the tool can potentially find zero-day vulnerabilities — bugs that no one has seen before.

Why CISA Needs AI-Powered Scanning

The federal government runs thousands of software applications, many of them decades old. Legacy systems are notoriously fragile. They often contain unpatched vulnerabilities, outdated libraries, and code written before modern security practices became standard.

CISA’s Attack Surface Evaluation team has the unenviable job of stress-testing this sprawling digital infrastructure. They conduct red-team exercises, penetration tests, and code reviews. But the sheer volume of code is overwhelming.

That’s where Mythos comes in. It can triage large codebases, flagging the most promising leads for human analysts to investigate. It doesn’t replace the experts — it makes them faster.

Privacy, Security, and Trust Concerns

Giving an AI system access to government source code raises obvious questions. Who controls the data? Could the model leak sensitive information? What happens if an adversary compromises the tool?

CISA and Anthropic have reportedly built safeguards. The system runs in a secure, air-gapped environment. No code leaves CISA’s control. Anthropic doesn’t get to see the vulnerabilities discovered — only aggregated performance metrics.

Still, the arrangement is likely to draw scrutiny. Critics will ask whether relying on a private company’s AI for government security introduces new risks. Supporters will argue that the status quo — underfunded, overworked human teams — is far riskier.

The Bigger Picture: AI in Government Cybersecurity

CISA isn’t the only agency exploring AI-assisted security. The Department of Defense has experimented with machine learning for threat detection. The NSA uses automated tools to analyze network traffic. But this appears to be one of the first instances of a civilian agency deploying a bespoke LLM for offensive-style security assessments.

If the pilot succeeds, expect more agencies to follow. The technology could eventually be used to scan critical infrastructure — power grids, water systems, transportation networks — for vulnerabilities before attackers find them.

For now, though, the focus is on federal software. And if Mythos proves its worth, it could become a standard tool in CISA’s arsenal. The agency has not officially confirmed the arrangement, but multiple sources have described it to SecurityWeek and other outlets.

One thing is clear: the era of AI-assisted vulnerability hunting has arrived. And the government is leading the charge.