Case tenable-hackedgptPrompt injectionUnited States
HackedGPT: Tenable finds seven ChatGPT flaws including persistent memory injection
Tenable disclosed seven ChatGPT weaknesses including zero-click injection via search, one-click URL injection, a Bing redirect bypass and persistent memory injection that leaks data across sessions. OpenAI fixed some.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Nov 5, 2025
- Location
- United States
- Target
- OpenAI ChatGPT (GPT-4o and GPT-5)
- Severity
- High
- Triggered by
- Tenable Research
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Tenable disclosed seven ChatGPT weaknesses including zero-click injection via search, one-click URL injection, a Bing redirect bypass and persistent memory injection that leaks data across sessions. OpenAI fixed some.
Impact: Demonstrated theft of chat history and data from connected services such as Google Drive, plus persistent compromise of a user's ChatGPT via memory. No confirmed real-world abuse
Who triggered it
Actor: Tenable Research
Attribution: Responsible disclosure by Tenable; vulnerabilities demonstrated in lab conditions
Motive: Security research
How it happened
Attack vector: Indirect prompt injection in web pages indexed by ChatGPT search, crafted chatgpt.com query links, trusted Bing wrapper URLs, markdown code-block tricks and writes to long-term memory
Root cause: Browsing, search and memory subsystems shared context without isolating untrusted content from user instructions, and URL safety checks trusted wrapper domains
Timeline
- Tenable reports the issues to OpenAI during GPT-4o and GPT-5 testing
- Tenable publishes the HackedGPT research
- OpenAI confirms some flaws fixed; others remained reproducible on GPT-5 at publication
Response
OpenAI remediated several of the seven issues; Tenable said some remained unaddressed and urged isolation of browsing, search and memory contexts
Current status: Patched
Sources (open in a new tab)
- TechRadar techradar.com
- iTWire (Tenable guest research) itwire.com
- SecurityBrief Asia securitybrief.asia
Cite this case
HackedGPT: Tenable finds seven ChatGPT flaws including persistent memory injection. AI Threat Watch, case tenable-hackedgpt, Nov 5, 2025. https://aithreat.io/cases/tenable-hackedgpt/
Permanent link: https://aithreat.io/cases/tenable-hackedgpt/