Chrome silently installs a 4 GB local LLM on your computer Google Chrome will steal 4 GB of disk space from your computer for its local large language model unless you opted out. It's called weights.bin and it's stored in a folder called OptGuideOnDeviceModel. What's more, if you track down the file and delete it, Chrome will download a fresh copy and reinstate it. The discovery was …
It's highly ironic that Google are now discussing rolling out draconian, privacy killing additions to recaptcha to help web site owners defend against the onslaught of LLM agents that Google and their buddies created.
See: https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-fraud-defense-the-next-evolution-of-recaptcha/
> but recently needed to download the UK government's One-Login app to my mobile phone. I wasn't allowed to proceed unless I logged into a Google account first! Bastards.
I call BS.
There's a long list of ways to identity yourself to One Login given on the web page below but none of them are a Google account.
https://www.gov.uk/using-your-gov-uk-one-login/proving-your-identity
"Even with the correct answers, you can fail this test, and others, leaving you with the Apple or Google app left as the only resort."
This is also not the case. I failed the online Experian test, probably since my credit score is actually a great big 0. You can in fact ask for a 'Request for Identity' form that you can present at a UK Post Office along with eg a driving licence, passport. I know, I literally did it today.
No. The point of digital identity is to track everything you do online, and thus to track you everywhere and always. And then to make sure that all services and access are online-only or online connected wherever possible.
Somewhere the ghost of George Orwell weeps for us forever.
My head banging moment with the guv's 1 login app involved them telling me my smartphone was not smart enough as it didn't have a tag reader to validate using my passport. So armed with their letter of instructions to wander off to a specialised Post Office and get verified I went.
The Post Office took photographs of my passport and me, and when asked about the tag thing, they looked at me strange and said "No. Just piccys". So a process I could quite easily have accomplished from my settee with my mobile turned into a safari adventure across the city to find 1 of only a handful of Post Offices that could do this wonderful thing...taking a bleeding photograph...Argghhhhh!!! The sooner Reform get in and drag us all back into the ocean for a more simpler life, the better.
"a safari adventure across the city to find 1 of only a handful of Post Offices that could do this wonderful thing...taking a bleeding photograph"
A very up to date photograph rather than the 8 year old passport photo and all the the info they need for a good read in the facial recognition application. I won't allow my FB-sister to take my photo. She wants to post it and tag me so it's easier in future for them to recognize me and save her the work. Yeah, not interested. The last time I had to visit the Department of Motor Vehicles to get a license renewal, I let all the hair grow so my photo looks pretty rough. I haven't needed to renew my passport (haven't gone anywhere needing one) and I'm not sure it would be a good idea to do the same thing. I don't want to get held up at some intermediate stop somewhere and miss flights, etc. Since I have more time these days, I'm thinking about getting passage to Blighty on a cargo ship rather than flying to visit some friends. It's not that straight-forward and one must tolerate last minute itinerary changes, but it's cheaper than booking a room in a liner that only does the trip a couple of times per year. NY(ish) to Felixstowe would be around a grand and takes around 10 days. They even let you wander around a bunch and the food can often be quite good.
It looks like it's coming down to a choice of who do you trust most (or, more accurately, distrust the least) between Apple and Google. Personally, I'll take Apple - their walled garden might limit some tweaks but it ensures everything works as it's meant to, most of the time. And I reckon the extra cost in $, € or £ is worth the additional privacy (even if it's not perfect). YMMV, of course.
And, as far as Chrome is concerned, it doesn't get near my laptop (on macOS, Windows nor Linux) - the only instance of it I have is on a Chromebook I use solely for skills sessions I help run for the elderly, some of whom received free ones from government sponsored projects during the Covid-19 lockdown.
Google is the Internet's most prolific advertising offender and privacy violator. It's central and inherent to their business model.
Apple has allowed advertisers and data harvesters to run wild on its platform, but at least it still has a reason to be if it just stuck to hardware and paid services.
I remember seeing adverts many years ago for Sure for Men - it's main play was that it didn't leave a mark on your clothes, so bugger me, when I bought a can it did the one thing that no other deodorant had ever done before. It left a white residue on my T shirts. That and other products have left me very wary of buying anything made in America.
"Woohoo, now you need an Android or iOS phone to complete a Captcha. "
AND be somewhere that has service.
Didja see the article about the lady that got a parking fine for not paying the fee within 5 minutes. I think it happen numerous times where she worked. There was no signal at the car park and she had to walk until she had signal which could take longer than they allowed. It took a lot of doing for her to get the fines reversed.
And don't assume that when service (5g, 4g, 3g, whatever) is available, that you'll get any throughput.
I pick up a colleague in the mornings who lives near to a primary school. Whilst I wait in the car I listen to music or podcasts etc to whyle* away the time. Don't you just know that as the parents start to flock in with their bundles of joy, data just stops flowing despite the full set of bars and "5g" tag. I don't know what the contention ratio is on UK cells, but it can't cope with even these meagre gatherings.
* I just prefer using the old English spelling in this context.
This post has been deleted by its author
I guess it depends what the alternative is.
If the choice is AI or no-AI, probably no-AI at this point, at least in Chrome (I use it for other things).
If the choice is between local AI and non-local AI, then I think I prefer the local AI, thanks.
Personally, I seem to have a laptop that is old/crap enough that Chrome doesn't even bother trying.
It's a PoC that lets them shift the compute costs onto the device and still harvest query metadata. If a large enough number of Chrome users install it, you can start running trial groups for query result comparisons between a web-hosted "full-strength" model and the Nano one on the device. If the output quality is similar (or tolerated) enough, you can gradually offload those from your servers for all Chrome users without much pushback.
Devices (particularly phones) and optimization processes are now mature enough to where most normal (non-dev/IT) people won't notice if their "how to make an apple pie" query result comes from a local model or a big web one hosted in a datacenter. For all the tech-inundated folks like those on this site, Google already has enough data on you to make that a single flag in your user profile and route your marginally more complex queries to a full-capability model instead.
"(Are you a Toy-R-Us kid?)"
They've been out of business for a while now. If you were a We B Toys kid, there's a good chance you are over 18 now. If you were a young TRU kid, maybe. In the US, they shut in 2018 and Wikipedia says they live on in a few worldwide locations.
I went in one time looking for some of the Lego automation stuff and they didn't stock it. No, model kits,model rockets and everything else was inexpensive/high markup Chinese tat. Sad. I think I was too depressed to see if they still had Erector sets (Mechano), Tinkertoys and Lincoln Logs. Things I remember from my childhood. Also the stuff that doesn't need batteries, subscriptions or much of anything extra to still be fun to play with.
If the choice is between local AI and non-local AI, then I think I prefer the local AI, thanks.
If you don't have control of the AI, it's not local. They are just letting you pay for the GPU, RAM, and electricity to run it.
By definition, an LLM installed without your permission or knowledge is not under your control.
Silly person. You do understand appreciate that Google WILL, change their ToS in the future. This will mean that the ChromeAI that has been trained on you, probably exclusively, will now upload its data on you to Google. If you think otherwise, please explain your reasoning to the rest of us.
I have the official Google Chrome .deb installed on a Linux Mint machine, and it has the weights.bin file at ~/.config/google-chrome/OptGuideOnDeviceModel/2025.8.21.1028/weights.bin
It's dated 1st December and is (only) 2.7G.
I have changed the flag at chrome://flags/#optimization-guide-on-device-model to disabled and it has disabled across multiple Chrome profiles after a restart of Chrome. The weights.bin file is still there at the moment...
On my LMDE 7 machine, I found two different versions:
./.config/google-chrome/OptGuideOnDeviceModel/2025.8.8.1141/weights.bin
./.config/google-chrome/OptGuideOnDeviceClassifierModel/2026.2.12.1554/weights.bin
The first is 3.9 GB, the second is 120.1 MB.
I just set their permissions to 000 and ownership to root:root to see what happens.
I thought I'd reply with an explanation for those terminally deficient in the sarcasm-detection department.
$ chmod +s weights.bin
will set the SETUID bit, which means the file will execute with the permissions of the file owner. If that's root, well, it would open up a big attack surface. If as Jou suggests the owner:group is nobody:nobody then it would be much safer. That user and group is present in /etc/passwd specifically to be the least privileged.
There goes the idea that ~/.config should for small valuable configuration files the user definitely wants to include in backups.
Well, it has been a lost cause for a long time. Open source generally tries to make the distinction – somehow, as the boundaries what should go where are not always clear. But commercial software puts anything anywhere, including GB-sized caches into ~/.config despite ~/.cache existing exactly for that, so GB-sized LLM weights are not such surprise.
Many years ago when I tried Chrome on an aging XP box, I found that it had installed itself into C:\Documents and Settings\UserName\Local Settings\Application Data\ rather than somewhere sensible like "Program Files" with all the other things.
So Google installing stuff where they feel like and to hell with what that location is supposed to be for? Totally on brand for them.
From what I'm hearing, it'll do it even if you did opt out. And will download the LLM again if you delete it. You've actually got to prohibit it at the registry level, or through enterprise tooling that individuals won't have. Just straight up malware.
I'm not sure whether this will hold or not but I've at least attempted to disable on my Ubuntu 26.04 installation with
rm -rf ~/.config/google-chrome/OptGuideOnDeviceModel
touch ~/.config/google-chrome/OptGuideOnDeviceModel
chmod 0444 ~/.config/google-chrome/OptGuideOnDeviceModel
No complaints yet but my use of Chrome is limited to testing as I use Waterfox for my general day-to-day web interaction.
> I've at least attempted to disable on my Ubuntu 26.04 installation
Like I wrote, I have not tried it because I didn't have it, but reports online say that if you remove it, it re-downloads it. And no, leaving an empty file there doesn't stop it. Making it read-only doesn't either.
That's why I linked to methods to _tell Chrome not to do it_ rather than OS-level attempts to block it.
What does it do without write permission?
Does Chrome use a different filename if the write location is root-only? If Google is being that deliberately evasive of user preference, well that's just as big a story as the bundled AI.
(Not a Chrome user and not giving Google any foothold on anything short of a disposable, test VM.)
Things don't work that way on Linux - OTOH, since the browser runs in the user's context, it might. It can create and delete cache files, after all. So it'd be necessary to chown the empty file besides setting permissions to 0444.
So it'd be necessary to chown the empty file besides setting permissions to 0444.
probably won't work, ability to unlink a file does not depend upon the file's ownership, but instead upon having write permission to the directory it is in
just make it immutable with chattr +i, that'll do the trick :)
Following up, Liam is correct, Chrome eventually just barges ahead, deletes, the file, and downloads its data.
However, you can (apparently) thwart this behavior by changing ownership to 'root':
/usr/bin/sudo chown root:root OptGuideOnDeviceModel
I chmod-ed to 0000 as well out of sheer bloody-minded, pigheaded perversity but I'm not sure that it makes any difference.
In any event, I've been running some tests in Chrome over the past couple of hours and the "fix" is seeming to hold.
"No complaints yet but my use of Chrome is limited to testing as I use Waterfox for my general day-to-day web interaction."
The ONLY thing my Minty mini PC does is run Chrome. I haven't needed it for a while and now I'm concerned that I'm going to get hit with a whopping big update before I will be able to do any work on it. Grrr.
Looking at the docs, no API has been launched yet, they are all experimental so far. See the whole list:
https://developer.chrome.com/docs/ai/built-in-apis
In any case, according to the docs, the weights are downloaded the first time a site tries to use one of those APIs, if the system has enough power (and at least 22 GB available on the profile's drive) to run a local model.
Given that nothing has officially shipped, I'm not surprised there's no setting to restrict which sites can use (or request access to) the model.
If you are using Active Directory, you can add the Chrome ADMX templates and stop the model from auto downloading. We just implemented it today and may also set up a scheduled task in the same GPO temporarily to blow away the model. We only have one approved AI service and tenuously so. Anyway it's Computer Config > Admin Templates > Google > Chrome > Gen AI > Settings for GenAI local foundational model: Enable and set to "Do now download".
And now you've subliminally motivated me to cue up an early 90s choonz playlist on my Musicbee while I work. Things like
The Prodigy - Out of Space; The Shamen - Ebeneezer Goode / LSI / Boss Drum; Urban Cookie Collective - The Key The Secret; Urban Hype - A Trip To Trumpton; KLF - Justified and Ancient; Stereo MC's - Connected; Happy Mondays - Step On
Ah, happier times. In the immortal words of Jarvis Cocker,
"and you want to call your mother and say / Mother, I can never come home again / cos I seem to have left an important part of my brain somewhere / somewhere in a field in Hampshire."
(Edit: perhaps, as part of their technical overhaul, the Reg team will fix the bug that inserts all the extra linebreaks in comments? I had to put the tracklist onto one line, because otherwise it
looked
like
this)
No I dont think that is the case. As I explained in the article, it is difficult to reproduce simply because of the way Google does this.
First the browser has to have been idle for a certain amount of time (I don't now exactly how long, but in my case the browser was idle for a 300s window (precisely - it was opened and closed programatically after a 5 minute dwell as part of a script).
What I noticed through monitoring was that Google remotely changes a flag in your browser profile (I don't mean your Google account, I mean the browser profile - I should add that this Chrome install was fresh and the profile folder was wiped after each test - it was not a logged in Chrome session) it is only after that flag changed that the model downloaded and even then it didn't happen straight away, it seemed to have been queued in some way.
Also, the settings that Google is talking about in their public response - they don't actually exist. Sure they might exist on "some" machines (and Google states they are currently "rolling out" the ability for some users to "Opt Out" - even the flags in Chrome://flags didn't exist until Google flipped that profile flag - after that, the flags appeared.
I mean all of this is in the article but seems to have been glossed over in favour of Google's excuses...
Just to be clear, since this seems to have been missed by Liam - this proves that Google's response is bullshit:
"Chrome's ChromeFeatureState for the audit profile lists OnDeviceModelBackgroundDownload<OnDeviceModelBackgroundDownload and ShowOnDeviceAiSettings<OnDeviceModelBackgroundDownload in the enable-features block. The first flag is what triggers the silent download. The second flag is what reveals the on-device AI section in chrome://settings. Both are gated by the same rollout flag - which means that by Chrome's own architecture, the install begins before the user has any settings UI in which to refuse it. The settings page that would let you discover the feature exists is enabled in lockstep with the install - it is design, not oversight."
My apologies, in my previous comment I referenced chrome://flags but I meant chrome://settings - it has been a really long and really crazy week.
Each userprofile suddenly explodes by 4 GB. For > 100 or > 1000 users. Whichever of the currently four widely available methods of userprofile is used: Several hundred GB to a few terabytes more space needed. Of course there are several methods to deal with it, but unannounced rapid storage usage increase is not welcome. Some customers cannot uninstall that browser, since some vendor/supplier/etc webpages only work with that...
It would and it does. But only rare cases have "Live deduplication" active since it eats too much resources. So for most it eats a lot first. And depending on how the dedup is implemented it is not as effective. Server 2012 (and later) dedup is quite good sich is uses rather small block sizes of 32k by default. But how long will it continue to work? MS is still in the habit to break more things than fix them...
We can all trust Google to not be using multiple PCs to create a distributed LLM. Google won't be borrowing the processing power of all those ̶m̶u̶g̶s̶ users who installed Chrome to create a multi-CPU beast of a machine. Google certainly would never think of borrowing each Chrome user's CPU power to merge into one huge processing beast.
When was the last time you read Chrome's Ts and Cs?
I wouldn't know. Vivaldi and Brave is as close as I ever get to Chrome on a PC.
I have been a Firefox user for a Very Long Time. I do not, and will not, have Chrome installed on any of my machines. Apple devices have Safari, the very few MS machines left have Edge (which is rarely used), and all systems have Firefox.
There are several reasons why I have never installed Chrome. This is just a new one.
Are these AIs convincing managers to spread them? Multiply them all over people's hard discs? That's certainly a new spin on computer viruses.
AIs are smart, they are doing all the fun stuff, whilst humans do the boring stuff
Thank heavens I'm a Firefox-only kinda guy. Give or take Floorp, too, for some stuff.
OK, this sounds bad. Bad google, bad chrome, LLM, user permissions, unlawful...
There is another aspect of it that I found shocking, looking at the environmental impact calculated in the linked blog...
The "Privacy Guy" seems to know what he's talking about:
4GB pushed to ~30% of Chrome users (1 billion that would be (*) ) cost 240 GWh - this is the equivalent of "the annual electricity consumption of about 72,000 average UK households", or "annual emissions of 13,000 cars".
(*) debatable number of Chrome users that were "pushed", but I suppose the calculations are realistic.
So, forgive me for the apparent diversion but how is this different from smart TV streaming - similar 4GB per TV per hour?
And there are 1 billion smart TVs in the world!
PS. Just to be clear, I'm not saying the way 4GB weights.bin was handled is acceptable, but if the numbers in the blog are reliable, WTF are we doing?!
... would be the grassroots AI community managing to jailbreak the model and enabling it to run entirely divorced and isolated from Google itself. Even better if they figured out how to (re)train it or interface it with other (existing) data. At that point, there's a wonderful poetic justice in Google trying to make people more dependent ... and giving people more independence instead.
Delete the weights.bin file from the folder they placed it in. Now make a new folder in that folder with the name weights.bin.
Registry and permissions being overridden be-damned it the name already exists, it can't be duplicated.
Once had a colleague who installed System Centre on all the PC's (bastard) and after that my desk machine stopped getting updates from Micros~1. Removing SCCM is no simple task but having done so, I prevented the reinstall by creating file names that duplicated the names of the folders that the SCCM installation wanted to create. Updates resumed but of course that's a mixed blessing :(
I know it's entirely possible for a simple script to undo any and all of the preventative measures taken but if that happened then hopefully, they'd be falling foul of something in the Computer Misuse Act.
I don't use Chrome. I've always considered it spyware disguised as a browser. So many commentards above have strongly recommended removing it or better still, never installing it in the first place. I agree with them 100%.
Re: @wsws: "all of the big tech companies are leftist"
Odd concept of "left".
Is this an American thinking? Leftover from cold war years? When the enemy was "commies"?
So being on the left of the political spectrum (i.e. Democrats in US) is automatically associated with Commies, i.e a bad thing? Do you really believe the techbros have anything to do with communism!?
Rhetorical, no need to answer, I'm not getting into this debate here.
Yeah, it's an American political thing.
Over here, the fringe types see communism hiding everywhere, including in things like the metric system. Not kidding.
The US would have already gone metric if conspiracy theorists didn't think it was an international communist plot.
The metric system is a curse of the French and their ability to be off by a decimal place or two in either direction and still get an answer that looks correct, and would be simply by adding a 'k' or 'd' after the number making it kg or dg or km or dm. On the other hand, factoring by 12/1760/5280 incorrectly will give you a wildly incorrect looking (and actual) answer.
> The US would have already gone metric if conspiracy theorists didn't think it was an international communist plot.
1975 metric act. Which is why many items have both numbers on them.
I remember when the Reg used to be a cutting-edge technology publication. One that had an open mind about everything.
Now all the interesting writers have moved on and it is infested with crap like this, neophobic paranoid waffle at its finest.
AI won't take anyone's job any time soon. But you will lose your jobs to people like me who understand it and embrace it. Enjoy your tired vanilla existence Luddites.
...and after god-knows-how-many years of using Chrome at its completely factory-standard settings (apart from cosmetic changes like default fonts) I have no "OptGuideOnDeviceModel" folder anywhere on two computers, one running Win10 and one Win11. Where is it supposed to be? (And yes, I switched "View" to display hidden and system files & folders for purposes of this search)
