# PIR-2026-0018 - ShadowLeak: zero-click Gmail exfiltration via the ChatGPT Deep Research agent

- `id`: PIR-2026-0018
- `title`: A hidden-instruction email coerces OpenAI's ChatGPT Deep Research agent into silently exfiltrating Gmail PII from OpenAI's own cloud (service-side, invisible to enterprise defenses)
- `date_occurred`: not applicable - vulnerability window; PoC operational before June 2025 report
- `date_detected`: 2025-06-18 (reported to OpenAI via Bugcrowd by Radware)
- `date_disclosed`: 2025-09-18 (Radware public advisory; OpenAI fix acknowledged 2025-09-03)
- `status`: corroborated (Radware advisory + The Hacker News + Security Affairs + Infosecurity)

### The agent
- `agent_description`: ChatGPT Deep Research agent connected to Gmail (and other connectors - Drive, Outlook, Teams, GitHub); agentic browser that autonomously reads the inbox and fetches URLs to compile research.
- `operator_type`: enterprise (OpenAI-operated) serving individual/enterprise users
- `autonomy_level`: autonomous-within-policy (agent autonomously browses, reads mail, and fetches URLs once a Deep Research task is launched)
- `model_stack`: OpenAI Deep Research agent (model version not disclosed)
- `harness`: ChatGPT agent runtime with Gmail connector and server-side `browser.open()` fetch capability

### Authority
- `authority_scope`: data access (connected Gmail inbox + PII), external comms (server-side HTTP fetch to attacker URL)
- `funds_at_risk_usd`: unknown (data-confidentiality incident)
- `blast_radius`: customers/third parties (any user who runs Deep Research over an inbox containing the crafted email)
- `failure_locus`: harness (OpenAI's agent runtime + connector + server-side fetch path)

### The failure
- `root_cause`: prompt-injection (primary; indirect, via hidden email content)
- `mechanism`: An email hides instructions using white-on-white text / tiny fonts. When the user runs Deep Research over the inbox, the agent reads the email, collects PII, Base64-encodes it (framed to the agent as a "security measure"), and calls `browser.open()` on an attacker URL with the data appended, retrying until it succeeds. Because the fetch executes server-side from OpenAI's cloud, the exfiltration is invisible to local and enterprise network defenses. Radware reported a 100% success rate after tuning the payload.
- `adversary_present`: yes (attacker sends the crafted email; here, Radware researchers)
- `exploitation_status`: researcher-demonstrated (Radware against production ChatGPT Deep Research; no confirmed in-wild exploitation)

### Impact
- `severity`: near-miss (reliable service-side exfil proven; no realized third-party loss)
- `direct_loss_usd`: 0
- `indirect_loss_usd`: unknown
- `downtime`: none
- `data_exposure`: none realized; capability was full connected-inbox PII exfiltrated server-side

### Detection and recovery
- `detected_by`: third-party (Radware)
- `time_to_detect`: not applicable (proactive research)
- `time_to_recover`: ~6-7 weeks from report (2025-06-18) to fix (acknowledged 2025-09-03)
- `remediation`: OpenAI implemented a server-side fix (early August 2025; acknowledged resolved 2025-09-03)
- `structural_fix`: server-side mitigation of the agentic exfil path (OpenAI-side; specifics not fully published)
- `controls_that_worked`: none inherent pre-fix - the service-side fetch defeated local/enterprise network monitoring, which is precisely why the class is dangerous. Post-fix OpenAI-side controls are the functioning boundary.

### Evidence
- `telemetry_grade`: none/vendor-attested - "no in-wild exploitation" rests on OpenAI/Radware analysis; the service-side-only exfil claim comes from Radware's own analysis.
- `sources`:
  - https://thehackernews.com/2025/09/shadowleak-zero-click-flaw-leaks-gmail.html
  - https://securityaffairs.com/182334/hacking/shadowleak-radware-uncovers-zero-click-attack-on-chatgpt.html
  - https://www.infosecurity-magazine.com/news/vulnerability-chatgpt-agent-gmail/
  - https://hackread.com/shadowleak-exploit-exposed-gmail-data-chatgpt-agent/
  - https://www.radware.com/security/threat-advisories-and-attack-reports/shadowleak/ (Radware Threat Advisory, Sept 2025)
  - `independence`: strong - Radware primary + multiple independent outlets; the service-side-exfil and 100%-success claims are single-source (Radware).
- `confidence`: high on mechanism, dates, and 100%-success PoC; medium on the service-side-only characterization (Radware's own analysis, weakest link)

### Verification notes
- Report date refined to 2025-06-18 (via Bugcrowd) and fix acknowledged 2025-09-03; candidate's "reported June 2025 / fixed early Aug / disclosed 2025-09-18" is consistent and corroborated.
- Classification holds: `prompt-injection`, harness failure_locus, near-miss + `researcher-demonstrated`. No correction needed.