Loading story…
Security researchers at Radware have uncovered critical vulnerabilities in OpenAI's ChatGPT platform, specifically targeting its Connectors and Memory features. These flaws, named ShadowLeak and ZombieAgent, allow attackers to exfiltrate sensitive data from connected services such as Gmail, Outlook, and GitHub without user interaction. The attacks exploit the AI's tendency to follow embedded malicious instructions, enabling zero-click and one-click data theft, persistent access through memory modification, and even propagation to other users by harvesting email addresses. OpenAI initially attempted to mitigate these vulnerabilities by restricting dynamic URL modifications, but researchers demonstrated effective bypasses using pre-built static URLs, reviving the threat under the new moniker ZombieAgent.
The vulnerabilities highlight the inherent risks of integrating AI assistants with external systems and storing long-term user data for personalization. Attackers can embed hidden prompts in emails or files—using techniques like white text or tiny fonts—that are executed when ChatGPT processes the content, leading to stealthy data leaks via OpenAI's own servers. Despite OpenAI's efforts to patch the flaws, the reactive nature of these fixes has left the platform susceptible to new variants, underscoring the ongoing challenge of securing AI-driven services against prompt injection and data exfiltration attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Multiple outlets reported Radware's public disclosure of the ShadowLeak and ZombieAgent attacks, detailing how ChatGPT could be abused to exfiltrate sensitive data and plant persistent memory entries. The reports emphasized that OpenAI had patched specific issues but that systemic weaknesses in agentic AI security remained unresolved.
OpenAI addressed the full set of reported issues with additional mitigations on December 16, 2025. The fixes targeted the connector and memory abuse techniques Radware had demonstrated, though researchers said underlying prompt-injection risks remained.
Radware disclosed the fuller set of vulnerabilities to OpenAI in September, including techniques for persistent memory manipulation, server-side exfiltration, and organizational propagation. The report showed attackers could leak data, alter stored information, and create worm-like spread through connected services.
After OpenAI's first fix, Radware discovered a bypass called ZombieAgent that revived the data-exfiltration risk. The new technique used static URLs and abused ChatGPT's memory and connectors to enable stealthy, persistent, zero-click or one-click attacks.
Following Radware's disclosure, OpenAI implemented a fix for the ShadowLeak issue by restricting dynamic URL modification and related attack paths. The mitigation was intended to stop prompt-injection-driven data exfiltration through ChatGPT connectors.
Radware identified an initial vulnerability, dubbed ShadowLeak, in ChatGPT's Deep Research and connector functionality. The flaw allowed hidden prompts in connected content and services to trigger unauthorized actions and leak sensitive data from sources such as Gmail, Outlook, Google Drive, and GitHub.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcearstechnica.com
Open sourcego.theregister.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tenable Research has identified seven novel vulnerabilities and attack techniques in OpenAI's ChatGPT, including indirect prompt injections, exfiltration of user data, and bypasses of safety mechanisms in the latest GPT-5 model. These vulnerabilities allow attackers to manipulate the large language model (LLM) through crafted inputs, potentially leading to the theft of private information from user memories and chat histories, even when users simply interact with ChatGPT. The research highlights that hundreds of millions of users could be at risk, as attackers can exploit these weaknesses to bypass safeguards and extract sensitive data without user awareness. The release of OpenAI's ChatGPT Atlas, an AI-powered browser that remembers user activities and acts autonomously, further amplifies these concerns. Security experts warn that features such as persistent memory and autonomous actions increase the attack surface, making the browser susceptible to prompt injection and other AI-specific vulnerabilities. The implications for enterprise security and privacy are significant, as these AI-driven tools become more integrated into business processes, necessitating new approaches to identity management, access controls, and oversight to mitigate the risks posed by advanced AI-enabled attacks.
Jul 23, 2026
Tenable security researchers identified seven new methods to extract private data from ChatGPT chat histories, primarily through indirect prompt injection attacks that exploit default features such as conversation memory and web search capabilities. These vulnerabilities, present in the latest GPT-5 model, allow attackers to embed malicious instructions in web content, which can then be processed by ChatGPT's intermediary model, SearchGPT, during browsing or search operations. The architectural separation between ChatGPT and SearchGPT was intended to limit such risks, but researchers demonstrated that prompt injection remains a viable attack vector, potentially exposing sensitive user information without their knowledge. Separately, a privacy incident was uncovered where highly sensitive ChatGPT user prompts were found leaking into Google Search Console reports, exposing private conversations to website administrators. Investigators suggested this may have resulted from OpenAI scraping Google Search with actual user prompts, though OpenAI only confirmed a temporary glitch affecting query routing and stated the issue was resolved. These incidents highlight ongoing privacy and security challenges in large language model deployments, especially regarding prompt handling, web integration, and the safeguarding of user data.
Jun 29, 2026
Researchers at Zenity Labs disclosed **AgentForger**, a vulnerability in OpenAI's ChatGPT Workspace Agents Builder that allowed a single attacker-crafted ChatGPT link to silently create and publish a malicious AI agent inside a victim's authenticated corporate workspace. The issue affected users who were logged into ChatGPT, had access to workspace agents, and had administrator-approved connectors or actions available. According to the disclosure, the flaw abused URL parameters including `template_name` and `initial_assistant_prompt`, causing security-sensitive instructions to be auto-submitted and executed instead of presented for review, effectively creating a CSRF-style cross-site agent forgery attack. Once deployed, the forged agent could inherit the victim's connected services and permissions across tools such as Outlook, Gmail, Slack, Teams, Google Drive, and SharePoint, disable approval prompts, schedule recurring execution, and use the victim's mailbox as a command channel. Zenity said the rogue agent could search corporate data, map internal projects and personnel, extract sensitive documents and credentials, send messages as the employee, and conduct internal phishing or fraud through trusted collaboration platforms before exfiltrating results by email. OpenAI was notified through Bugcrowd on June 4 and fixed the issue by June 8 by removing the vulnerable URL parameter before the public disclosure.
Jul 27, 2026