Kaito AI’s new Kaito Pulse browser extension has drawn scrutiny after a source-code review claimed the software can fingerprint devices, track detailed activity on X, and access account data from several third-party platforms during user-initiated verification.
Summary
- Kaito Pulse has come under scrutiny after an analyst reviewed the browser extension’s source code.
- The extension allegedly fingerprints devices and records X activity including viewing time, clicks, searches and bookmarks.
- ChatGPT, Claude and Binance access only occurs when users initiate verification, according to the analyst.
- Kaito launched Pulse on Aug. 18 alongside Aura, a metric combining attention with verified user activity.
- Kaito had not publicly responded to the analyst’s findings at the time of writing.
According to well-known analyst Ultra, who reviewed Kaito Pulse’s source code, found multiple forms of data collection, with the most extensive logging tied to how people use X.
The analyst later clarified that access involving ChatGPT, Claude and Binance only occurs when a user starts a verification process, and said only attestations from those checks are logged.
The findings came less than a day after Kaito launched Pulse on Aug. 18 as a browser extension that adds verified trading and other activity directly to the X interface. Kaito also introduced Aura, a metric designed to combine what users say online with verifiable actions such as trading or creator activity.
Kaito had not publicly responded to the analyst’s source-code findings at the time of writing.
Kaito Pulse allegedly creates a persistent device fingerprint
According to the source-code review, Kaito Pulse generates a device fingerprint using several hardware-related signals rather than relying only on a browser cookie or account identifier.
The analyst said the extension hashes the way a device’s graphics processing unit renders an invisible image, combines that information with the GPU model, and checks how the hardware processes a test audio tone. Together, the signals allegedly create an identifier that can distinguish one device from another.
Ultra said the fingerprint is then transmitted alongside the user’s X account ID. Under the analyst’s interpretation of the code, multiple X accounts used from the same machine could therefore be associated with one device.
The source-code review also claimed Pulse records considerably more information while a user browses X. According to the analyst, the extension can log every post delivered to a timeline, including posts that a user scrolls past without interacting with them.
The reported telemetry includes how long a post remained visible, measured in milliseconds, as well as clicks, follows, unfollows, searches, and bookmarks. Pulse also allegedly sends a heartbeat signal every 30 seconds and checks whether the user is idle, which the analyst said could be used to establish when a session was active and how long it lasted.
“The twitter side logging is the most interesting piece,” Ultra said in a follow-up post after clarifying how the extension handles verification on other services.
Google’s Chrome Web Store listing for Kaito Pulse separately states that the extension handles “user activity” and “website content.” Kaito declares in the listing that the collected data is not sold to third parties outside approved uses, is not transferred for purposes unrelated to the extension’s main function, and is not used to determine creditworthiness or for lending.
ChatGPT, Claude and Binance access is tied to verification
Access to other platforms works differently from the X telemetry described in the review, according to Ultra’s subsequent clarification.
The analyst initially said the extension could inspect a user’s ChatGPT and Claude subscription information, including which paid plan an account uses and how much of a rate limit has been consumed. No conversations were claimed to be accessed.
For ChatGPT specifically, the source-code analysis alleged that Pulse can open the account settings area and navigate to the usage section as part of the verification process.
Binance verification was described as more extensive. According to Ultra, Pulse can navigate to the Positions tab and resend authenticated requests from the user’s active session to obtain wallet balances, futures positions, profit and loss information, and deposit and withdrawal history.
After the original post prompted questions about the scope of that access, the analyst said Claude, ChatGPT, and Binance functions “only fire when you run a verification” and that “just the attestations get logged.”
The clarification means the analyst did not claim Pulse continuously collects ChatGPT, Claude, or Binance account information in the background. His concern about persistent collection was directed mainly at X activity.
Kaito’s Chrome Web Store description says the extension generates zero-knowledge Transport Layer Security, or zkTLS, proofs from third-party platform data and submits them to Kaito. According to the listing, Pulse allows users to view verified trading accounts and positions from X profiles, examine trader views around ticker symbols, and receive recommendations about accounts and assets to follow.
Ultra’s review said Pulse’s zkTLS implementation is based on a fork of Primus, an open-source project. The analyst also identified 12 domains supported by the extension, covering Binance, OKX, Bybit, Hyperliquid, Lighter, Polymarket, TradeXYZ, Variational, ChatGPT, Claude, X and Kaito. According to the review, only the Kaito domain is permitted to communicate directly with the extension.
Kaito Pulse puts verified activity inside X
Kaito introduced Pulse as what it calls a “social layer for the internet,” beginning with X. The company said the extension is intended to bring activity that previously sat outside social feeds, including trading and other verifiable actions, into a user’s timeline.
At launch, public activity from platforms including Polymarket and Hyperliquid could be surfaced alongside X profiles and posts. Users can therefore inspect verified trading information without leaving the social platform, while traders can attach a verifiable record to positions or views they discuss publicly.
Aura accompanies the extension as Kaito’s new attention metric. Kaito said the score combines content, verified activity and existing Yaps-related information to measure attention generated by both statements and actions. Users can establish or increase Aura through existing Yaps, creator or trading verification, installing Pulse and referrals.
The launch extends Kaito’s longstanding use of social and market data. A previous crypto.news overview detailed how the platform built products around collecting crypto information from social media, analytics services, forums and other sources, while its Yaps system measured engagement such as views and interactions.
Pulse follows Kaito’s earlier changes to Yaps
Kaito’s approach to X-based engagement changed significantly earlier this year after the platform ended its original Yaps product and incentivized leaderboards.
In January, Kaito ended Yaps after X changed its rules to prohibit applications that reward users for posting content. Kaito founder Yu Hu said at the time that the company had discussed the matter with X and that a fully permissionless distribution system was no longer compatible with the platform’s policies.
Yaps had allowed users to earn points and KAITO-linked rewards based partly on crypto-related activity on X. The shutdown followed complaints around automated and AI-generated posts as users competed for rewards, with Kaito subsequently moving toward more selective creator products.
Kaito had also used social reputation and onchain activity in other products before Pulse. In July 2025, the company introduced Capital Launchpad, where project allocations could consider factors including social reputation, regional affiliation, onchain activity and a participant’s relationship with a project.
Pulse now packages similar ideas around verifiable identity, activity and reputation directly into the browsing experience on X. According to the Chrome Web Store, version 1.0.1 of the extension was updated on Aug. 17 and is offered by Kaito Pte. Ltd. The store lists the extension at 10.69 MB and says it can generate zkTLS proofs of data obtained from third-party platforms.
As of Aug. 19, Kaito’s public launch materials focused on Pulse’s trading verification, social discovery and Aura features, while the company had not issued a public response addressing ultra’s claims about device fingerprinting or the scope of X session telemetry.
