agent_description: ChatGPT macOS desktop app with the Memory feature; browsing/document analysis supplies untrusted input; persistent Memory carries state into every future session.
mechanism: A malicious website or document analyzed by ChatGPT carries hidden instructions that write attacker commands into persistent Memory. Because Memory loads into every future conversation, all subsequent user messages and replies are appended to an attacker URL rendered as a markdown image and auto-fetched - continuous exfiltration surviving session end and chat deletion. OpenAI patched the exfiltration vector in macOS app v1.2024.247; the memory-injection primitive itself remains a design-level risk.
adversary_present: yes in the demonstrated scenario (attacker-planted content); no known real-world attacker
exploitation_status: researcher-demonstrated (production app, working end-to-end demo; no known in-wild use)
Impact
severity: near-miss (full demonstrated exposure path; zero known realized loss)
direct_loss_usd: 0
indirect_loss_usd: 0 known
downtime: none
data_exposure: none confirmed in the wild; demo showed full conversation-stream exfiltration
Detection and recovery
detected_by: third-party (independent researcher Johann Rehberger, coordinated disclosure)
time_to_detect: n/a (vulnerability, not a discrete event)
time_to_recover: exfil vector closed in v1.2024.247
remediation: vendor patch blocking the URL-fetch exfil channel in the macOS app
structural_fix: partial - the exfil channel is closed but attacker-writable persistent memory remains; user-side memory review is the remaining mitigation
controls_that_worked: coordinated disclosure worked as intended; the Memory UI makes planted state user-inspectable (a weak detective control, but the only one that survives the patch)
Evidence
telemetry_grade: operator-logs (researcher's own demo recordings; vendor patch corroborates the flaw was real)