Kaito AI’s new Kaito Pulse browser extension is facing privacy questions after a source-code review alleged that it can fingerprint users’ devices, record detailed activity on X and access account information from several third-party platforms during user-initiated verification.
The findings were reported by analyst Ultra, who examined the extension’s source code less than a day after Kaito launched Pulse on 18 August. Kaito had not publicly responded to the claims at the time of writing.
Ultra later clarified that the extension’s access to ChatGPT, Claude and Binance is triggered only when a user begins a verification process. According to the analyst, only attestations produced by those checks are recorded. The concern over ongoing data collection was focused mainly on activity taking place on X.
Kaito describes Pulse as a browser extension that brings verified trading and other activity into the X interface. The company also launched Aura, a metric intended to combine what users post online with verifiable actions such as trading and creator activity.
Device identification and X tracking
According to Ultra’s review, Kaito Pulse creates a device fingerprint using multiple hardware-related signals rather than depending solely on a browser cookie or account ID.
The analyst said the extension hashes the way a device’s graphics processing unit renders an invisible image, combines that result with the GPU model and checks how the hardware processes a test audio tone. Taken together, those signals allegedly produce an identifier capable of distinguishing one device from another.
Ultra said the fingerprint is sent alongside the user’s X account ID. Under the analyst’s interpretation of the code, several X accounts accessed from the same machine could therefore be linked to one device.
The review also claimed that Pulse records extensive information as users browse X. Ultra said the extension can log every post delivered to a timeline, including posts that users scroll past without clicking or otherwise engaging with them.
The reported data includes the amount of time a post remains visible, measured in milliseconds, along with clicks, follows, unfollows, searches and bookmarks. Pulse allegedly sends a heartbeat signal every 30 seconds and checks whether the user is idle. Ultra said that information could be used to determine when a session was active and how long it lasted.
“The twitter side logging is the most interesting piece,” Ultra said in a follow-up post after explaining the extension’s verification process on other services.
The Google Chrome Web Store listing for Kaito Pulse separately says the extension handles “user activity” and “website content”. Kaito states that data collected by the extension is not sold to third parties outside approved uses, is not transferred for purposes unrelated to its main function and is not used to assess creditworthiness or support lending decisions.
Verification on ChatGPT, Claude and Binance
Ultra initially said Pulse could inspect ChatGPT and Claude subscription information, including the paid plan attached to an account and the amount of its rate limit already used. The analyst did not claim that the extension could access users’ conversations.
For ChatGPT, the source-code review alleged that Pulse can open the account settings area and move to the usage section as part of a verification process.
The reported Binance access was broader. Ultra said Pulse can navigate to the Positions tab and resend authenticated requests from a user’s active session. That could provide wallet balances, futures positions, profit and loss information, and deposit and withdrawal history.
However, after questions were raised about the extent of that access, Ultra said the relevant functions “only fire when you run a verification” and that “just the attestations get logged.”
That clarification indicates Ultra was not claiming that ChatGPT, Claude or Binance account information is collected continuously in the background. The allegation of persistent monitoring relates primarily to activity on X.
Kaito’s Chrome Web Store description says Pulse produces zero-knowledge Transport Layer Security, or zkTLS, proofs from data held on third-party platforms and submits those proofs to Kaito. The company says the extension allows users to view verified trading accounts and positions from X profiles, explore traders’ views around ticker symbols and receive recommendations about accounts and assets to follow.
Ultra said the zkTLS system used by Pulse is based on a fork of Primus, an open-source project. The analyst identified 12 domains supported by the extension: Binance, OKX, Bybit, Hyperliquid, Lighter, Polymarket, TradeXYZ, Variational, ChatGPT, Claude, X and Kaito. According to the review, only the Kaito domain is allowed to communicate directly with the extension.
Kaito’s wider social and market-data strategy
Kaito launched Pulse as what it calls a “social layer for the internet”, starting with X. The company said it wants to bring activity that has traditionally remained outside social feeds, including trading and other verifiable actions, into users’ timelines.
At launch, public activity from platforms including Polymarket and Hyperliquid could be displayed alongside X profiles and posts. Users can inspect verified trading information without leaving X, while traders can attach a verifiable record to positions or views discussed publicly.
Aura is designed to accompany those features. Kaito said the score combines content, verified activity and existing Yaps-related information to measure attention generated by both statements and actions. Users can establish or increase their Aura through existing Yaps, creator or trading verification, installing Pulse and making referrals.
The extension continues Kaito’s broader focus on social and market data. The company has built products around information collected from social media, analytics services, forums and other sources, while its Yaps system measured engagement including views and interactions.
Kaito’s approach changed earlier this year when it ended the original Yaps product and its incentivised leaderboards. In January, the company stopped Yaps after X changed its rules to prohibit applications that reward users for posting content.
Kaito founder Yu Hu said at the time that the company had discussed the issue with X and that a fully permissionless distribution system was no longer compatible with the platform’s policies.
Yaps had enabled users to earn points and KAITO-linked rewards partly through crypto-related activity on X. Its closure followed complaints about automated and AI-generated posts as users competed for rewards. Kaito subsequently moved towards more selective creator products.
The company had also used social reputation and onchain activity in earlier products. In July 2025, it introduced Capital Launchpad, where project allocations could take account of factors including social reputation, regional affiliation, onchain activity and a participant’s relationship with a project.
Pulse brings similar ideas around verifiable identity, activity and reputation into the X browsing experience. The Chrome Web Store says version 1.0.1 of the extension was updated on 17 August and is offered by Kaito Pte. Ltd. It is listed at 10.69 MB and is described as capable of generating zkTLS proofs from data obtained through third-party platforms.
As of 19 August, Kaito’s public launch material had concentrated on Pulse’s trading verification, social discovery and Aura features. The company had not issued a public response to Ultra’s claims about device fingerprinting or the extent of Pulse’s X session telemetry.
