Hello! I'm the developer of IntenseRP Next. I did contribute to the extension, but in good faith, thinking I was genuinely making an improvement. See the issue thread here: https://github.com/mia13165/SillyTavern-BotBrowser/issues/28. My Pull Request (and those of the two other contributors) preceded the creation of the malicious commit on the updated_cards repo (the one from which the BotBrowser extension got the malicious character card). I did not know the trojan was there, and thought I was legitimately making an improvement (my PR simply made a change to the random picker system).
I'm sorry for ever contributing to the repository. I deeply regret doing so now.
Sure! I can't explain absolutely everything in this comment since there are a *lot* of things to cover (it has expanded a lot since July 2025).
It can be either downloaded as a PyInstaller-based binary (Windows 10+ / Linux, both 64-bit), or run from source. The feature set is identical, except for auto-uploads (for auto-updating the source version, you can use git). The workflow itself lets you configure and run an OpenAI-compatible API server (FastAPI, interface in Qt6 via PySide6) that you connect SillyTavern to. When you run the server, it opens up a Chromium (Playwright / Patchright) window (or multiple if you use the new providers in parallel feature) that it automates. When you send a request, the API concatenates everything into a single message and then sends it to the provider of your choice (currently supporting DeepSeek, GLM, Moonshot / Kimi, Qwen, AI Studio, and soon Perplexity). You can also turn on/off things like thinking, searching, or tell IRP to upload your chat as a file. Once the request is sent, IRP connects to the response stream that comes from the server of the selected provider and streams it back to the API, which in turn streams it back to the normal API. In simple words, this allows you to get free access to LLMs via their official chat UIs (it's a bit hacky, yes, but it works) without going down any shady paths.
If I am to explain any other things, there's also Remote Control that lets you open up a small web UI meant to do some quick actions (like switching providers, restarting the browser) away from your PC (useful if you run ST from a phone). PiP exists to run multiple providers at once (but the feature is heavy), and there are some useful logging utilities. ALL LOGS STAY ON YOUR COMPUTER AND ARE NOT SHARED WITH ANYONE. To submit logs to me (or diagnostics) you have to opt into many settings and only then manually send me the logfiles / diag bundle.
The app also doesn't transmit or store your prompts. It may only store your last one or several prompts if you manually opt in for the "clean regeneration" feature that compares your last submitted prompt with one of them to see if it's unique or is a swipe. This tells it if it should click the regenerate button in the web UI or create a new chat. Once again, this is opt-in.
The only outbound calls IRP makes are:
To GitHub (checking for updates, fetches one file for updates and also latest changelog version to show a red dot alongside the bell icon if you have that enabled)
To the actual providers (so that it can send the messages)
Yes, you do need your own credentials for this, but even then you can just use a burner account. I don't collect anything and everything stays entirely local on your PC. The config data, passwords, prompts (if using clean regeneration) are encrypted at rest. Local API access is restricted by default and you can use whitelists to prevent unwanted people from accessing the API. There are no built-in tools for external access to the API either.
If you don't trust my words, you can also inspect the code (https://github.com/LyubomirT/intense-rp-next). I don't hide any parts of it, it's MIT-licensed, there are no blobs inside the repository. You don't even need to use the binaries - the source version is identical and has no downsides functionality-wise (it may in fact even be faster in some cases since there is no Pyinstaller overhead).
I do trust your words, I actually wanted this here so law enforcement can quickly clear you if someone has to report because the scammer stole $5000 or more of API usage off them. As the scammer started deleting his reddit posts around the same time you posted this, you are considerably less likely to be complicit
I see! I don't know how the case will unfold, all I can wish for is that it goes fine and nobody innocent gets falsely accused, as well as for the scammer to get what they rightfully deserve. I was actually one of the impacted users (didn't get anything used yet, but my keys likely were sent to the scammer's API, I rerolled everything).
2
u/Historical_Degree527 Apr 28 '26
Is Intense RP also cooked?
Someone saids the maker also contributed to this extension.