Case shadowleak-deep-researchPrompt injectionUnited States
ShadowLeak: zero-click prompt injection makes ChatGPT Deep Research leak Gmail data
Radware showed hidden HTML in an email could make ChatGPT's Deep Research agent extract inbox data and post it to an attacker URL from OpenAI's cloud with no user click. OpenAI patched it in August 2025.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 18, 2025
- Location
- United States
- Target
- OpenAI ChatGPT Deep Research agent (Gmail connector)
- Severity
- High
- Triggered by
- Radware research team
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Radware showed hidden HTML in an email could make ChatGPT's Deep Research agent extract inbox data and post it to an attacker URL from OpenAI's cloud with no user click. OpenAI patched it in August 2025.
Impact: Proof of concept achieved reliable exfiltration of Gmail content; Radware warned the same technique could reach other connectors such as Google Drive, Dropbox, GitHub, Outlook and SharePoint. No real victims reported
Who triggered it
Actor: Radware research team
Attribution: Responsible disclosure by Radware researchers; no evidence of in-the-wild abuse
Motive: Security research and responsible disclosure
How it happened
Attack vector: Hidden HTML text in an email; when the user asks Deep Research to analyse the inbox, the agent calls browser.open with Base64-encoded personal data appended to an attacker URL
Root cause: Agent treated untrusted email content as instructions and could make outbound HTTP requests server-side, so exfiltration bypassed client-side URL checks and enterprise monitoring
Timeline
- Radware reports the flaw to OpenAI
- OpenAI deploys a fix
- Radware publishes the ShadowLeak write-up
Response
OpenAI patched the service-side exfiltration path in early August 2025 before public disclosure
Current status: Patched
Sources (open in a new tab)
- Security Affairs securityaffairs.com
- The Register theregister.com
- Infosecurity Magazine infosecurity-magazine.com
Cite this case
ShadowLeak: zero-click prompt injection makes ChatGPT Deep Research leak Gmail data. AI Threat Watch, case shadowleak-deep-research, Sep 18, 2025. https://aithreat.io/cases/shadowleak-deep-research/
Permanent link: https://aithreat.io/cases/shadowleak-deep-research/