New attack on ChatGPT research agent pilfers secrets from Gmail inboxes

New attack on ChatGPT research agent pilfers secrets from Gmail inboxes

Unlike most prompt injections, ShadowLeak executes on OpenAI’s cloud-based infrastructure.

Zero-Click Data Theft: Radware Exposes Major Security Flaw in ChatGPT Used by 5M Companies

Radware discovers ShadowLeak vulnerability enabling autonomous data theft through ChatGPT's Deep Research agent. Critical flaw affects 5M business users, bypasses security controls with no user action needed.

0-Click ChatGPT Agent Vulnerability Allows Sensitive Data Exfiltration From Gmail - Cybernoz - Cybersecurity News

A zero-click vulnerability discovered in ChatGPT’s Deep Research agent allowed attackers to exfiltrate sensitive data from a user’s Gmail account without any user interaction. The flaw, which OpenAI has since patched, leveraged a sophisticated form of indirect prompt injection hidden within an email, tricking the agent into leaking personal information directly from OpenAI’s cloud infrastructure. According to Radware, the attack began with an at…