Loading story…
A researcher disclosed a proof-of-concept vulnerability chain in ChatGPT that allegedly allowed access to files inside its sandboxed environment by combining a prompt-based guardrail bypass with a path traversal flaw in the file download workflow. The issue reportedly began when an uploaded file was made downloadable after the model was prompted to bypass its normal refusal to generate a download link for temporary files, producing a valid backend URL tied to the upload.
The researcher said the download endpoint accepted a manipulable sandbox_path parameter that could be altered with traversal sequences to retrieve restricted files such as /etc/passwd, effectively creating a local file inclusion primitive within the sandbox. OpenAI reportedly mitigated the issue by redesigning the URL download flow, and the write-ups noted that the sandboxed execution environment limited direct exposure of highly sensitive host data, though the flaw still illustrated how LLM guardrail manipulation can be chained with traditional web vulnerabilities.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
OpenAI remediated the reported issue by changing or redesigning the URL download flow, according to the researcher and subsequent reporting.
A researcher identified and documented a proof-of-concept chain in ChatGPT that allegedly combined a prompt-based guardrail bypass with a path traversal/local file inclusion issue in the file download workflow, enabling retrieval of files such as /etc/passwd from the sandboxed environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceinfosecwriteups.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research disclosed a now-remediated covert channel that allowed separate ChatGPT code-execution containers to exchange data despite account and network isolation. The flaw involved a shared internal JFrog Artifactory service: its Item Management API allowed containers to read and modify mutable metadata on cached repository items, effectively turning package metadata into a bidirectional cross-account communication channel. An attacker could deliver hidden instructions through a malicious prompt, shared conversation, or custom GPT, causing a victim’s ChatGPT session to execute concealed tasks alongside a benign visible request. In Check Point’s proof of concept, the session accessed data from a connected Gmail account and relayed it to the attacker while returning an innocuous response. OpenAI confirmed the affected internal Artifactory instance had been decommissioned before the report was completed.
Sep 9, 2026
Security researchers at Radware have uncovered critical vulnerabilities in OpenAI's ChatGPT platform, specifically targeting its Connectors and Memory features. These flaws, named ShadowLeak and ZombieAgent, allow attackers to exfiltrate sensitive data from connected services such as Gmail, Outlook, and GitHub without user interaction. The attacks exploit the AI's tendency to follow embedded malicious instructions, enabling zero-click and one-click data theft, persistent access through memory modification, and even propagation to other users by harvesting email addresses. OpenAI initially attempted to mitigate these vulnerabilities by restricting dynamic URL modifications, but researchers demonstrated effective bypasses using pre-built static URLs, reviving the threat under the new moniker ZombieAgent. The vulnerabilities highlight the inherent risks of integrating AI assistants with external systems and storing long-term user data for personalization. Attackers can embed hidden prompts in emails or files—using techniques like white text or tiny fonts—that are executed when ChatGPT processes the content, leading to stealthy data leaks via OpenAI's own servers. Despite OpenAI's efforts to patch the flaws, the reactive nature of these fixes has left the platform susceptible to new variants, underscoring the ongoing challenge of securing AI-driven services against prompt injection and data exfiltration attacks.
Jun 29, 2026
Tenable security researchers identified seven new methods to extract private data from ChatGPT chat histories, primarily through indirect prompt injection attacks that exploit default features such as conversation memory and web search capabilities. These vulnerabilities, present in the latest GPT-5 model, allow attackers to embed malicious instructions in web content, which can then be processed by ChatGPT's intermediary model, SearchGPT, during browsing or search operations. The architectural separation between ChatGPT and SearchGPT was intended to limit such risks, but researchers demonstrated that prompt injection remains a viable attack vector, potentially exposing sensitive user information without their knowledge. Separately, a privacy incident was uncovered where highly sensitive ChatGPT user prompts were found leaking into Google Search Console reports, exposing private conversations to website administrators. Investigators suggested this may have resulted from OpenAI scraping Google Search with actual user prompts, though OpenAI only confirmed a temporary glitch affecting query routing and stated the issue was resolved. These incidents highlight ongoing privacy and security challenges in large language model deployments, especially regarding prompt handling, web integration, and the safeguarding of user data.
Jun 29, 2026