PipeRoll - Agent Incident Registry ·
about ·
contribute ·
data ·
notes ·
constitution ·
seismograph ↗
ShadowLeak: zero-click Gmail exfiltration via the ChatGPT Deep Research agent
PIR-2026-0018PIR-2026-0018id: PIR-2026-0018title: A hidden-instruction email coerces OpenAI's ChatGPT Deep Research agent into silently exfiltrating Gmail PII from OpenAI's own cloud (service-side, invisible to enterprise defenses)date_occurred: not applicable - vulnerability window; PoC operational before June 2025 reportdate_detected: 2025-06-18 (reported to OpenAI via Bugcrowd by Radware)date_disclosed: 2025-09-18 (Radware public advisory; OpenAI fix acknowledged 2025-09-03)status: corroborated (Radware advisory + The Hacker News + Security Affairs + Infosecurity)agent_description: ChatGPT Deep Research agent connected to Gmail (and other connectors - Drive, Outlook, Teams, GitHub); agentic browser that autonomously reads the inbox and fetches URLs to compile research.operator_type: enterprise (OpenAI-operated) serving individual/enterprise usersautonomy_level: autonomous-within-policy (agent autonomously browses, reads mail, and fetches URLs once a Deep Research task is launched)model_stack: OpenAI Deep Research agent (model version not disclosed)harness: ChatGPT agent runtime with Gmail connector and server-side browser.open() fetch capabilityauthority_scope: data access (connected Gmail inbox + PII), external comms (server-side HTTP fetch to attacker URL)funds_at_risk_usd: unknown (data-confidentiality incident)blast_radius: customers/third parties (any user who runs Deep Research over an inbox containing the crafted email)failure_locus: harness (OpenAI's agent runtime + connector + server-side fetch path)root_cause: prompt-injection (primary; indirect, via hidden email content)mechanism: An email hides instructions using white-on-white text / tiny fonts. When the user runs Deep Research over the inbox, the agent reads the email, collects PII, Base64-encodes it (framed to the agent as a "security measure"), and calls browser.open() on an attacker URL with the data appended, retrying until it succeeds. Because the fetch executes server-side from OpenAI's cloud, the exfiltration is invisible to local and enterprise network defenses. Radware reported a 100% success rate after tuning the payload.adversary_present: yes (attacker sends the crafted email; here, Radware researchers)exploitation_status: researcher-demonstrated (Radware against production ChatGPT Deep Research; no confirmed in-wild exploitation)severity: near-miss (reliable service-side exfil proven; no realized third-party loss)direct_loss_usd: 0indirect_loss_usd: unknowndowntime: nonedata_exposure: none realized; capability was full connected-inbox PII exfiltrated server-sidedetected_by: third-party (Radware)time_to_detect: not applicable (proactive research)time_to_recover: ~6-7 weeks from report (2025-06-18) to fix (acknowledged 2025-09-03)remediation: OpenAI implemented a server-side fix (early August 2025; acknowledged resolved 2025-09-03)structural_fix: server-side mitigation of the agentic exfil path (OpenAI-side; specifics not fully published)controls_that_worked: none inherent pre-fix - the service-side fetch defeated local/enterprise network monitoring, which is precisely why the class is dangerous. Post-fix OpenAI-side controls are the functioning boundary.telemetry_grade: none/vendor-attested - "no in-wild exploitation" rests on OpenAI/Radware analysis; the service-side-only exfil claim comes from Radware's own analysis.sources:independence: strong - Radware primary + multiple independent outlets; the service-side-exfil and 100%-success claims are single-source (Radware).confidence: high on mechanism, dates, and 100%-success PoC; medium on the service-side-only characterization (Radware's own analysis, weakest link)prompt-injection, harness failure_locus, near-miss + researcher-demonstrated. No correction needed.