Generative AI assistants packaged up as browser extensions harvest personal data with minimal safeguards, researchers warn.