Case agentflayer-chatgpt-connectorsPrompt injectionUnited States
AgentFlayer: one poisoned Google Drive document makes ChatGPT leak API keys
Zenity Labs showed at Black Hat that a shared document with a 300-word prompt in 1-pixel white text could make ChatGPT search a victim's Drive for secrets and exfiltrate them via image URLs that bypassed url_safe checks.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 6, 2025
- Location
- United States
- Target
- OpenAI ChatGPT Connectors (Google Drive, SharePoint)
- Severity
- High
- Triggered by
- Michael Bargury and Tamir Ishay Sharbat (Zenity Labs)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Zenity Labs showed at Black Hat that a shared document with a 300-word prompt in 1-pixel white text could make ChatGPT search a victim's Drive for secrets and exfiltrate them via image URLs that bypassed url_safe checks.
Impact: Proof of concept exfiltrated API keys from Google Drive; researchers said any connected resource could be targeted
Who triggered it
Actor: Michael Bargury and Tamir Ishay Sharbat (Zenity Labs)
Attribution: Responsible disclosure presented at Black Hat USA 2025 as part of the AgentFlayer series
Motive: Security research
How it happened
Attack vector: Zero-click indirect prompt injection in a shared file; triggered when the user asks ChatGPT to summarise it
Root cause: ChatGPT rendered attacker-chosen image URLs from trusted cloud domains, giving a covert channel out of the connector context
Timeline
- Zenity presents AgentFlayer at Black Hat USA
- Wired and others report OpenAI deployed mitigations
Response
OpenAI reportedly patched the demonstrated exfiltration path after disclosure
Current status: Patched
Sources (open in a new tab)
- Zenity Labs labs.zenity.io
- Hackread hackread.com
- TechSpot techspot.com
Cite this case
AgentFlayer: one poisoned Google Drive document makes ChatGPT leak API keys. AI Threat Watch, case agentflayer-chatgpt-connectors, Aug 6, 2025. https://aithreat.io/cases/agentflayer-chatgpt-connectors/
Permanent link: https://aithreat.io/cases/agentflayer-chatgpt-connectors/