OpenAI fixed an issue that could have enabled attackers to exfiltrate potentially sensitive information from ChatGPT chats or connected services via indirect prompt injection,
Radware researchers disclosed Thursday.The data could have been exposed either server-side, through ChatGPT’s ability to open and browse links, or via the user’s browser through Markdown images output in a conversation, Radware said.
New exfiltration method bypassed previous guardrails
The latest fix further strengthens guardrails added by OpenAI after Radware reported another technique called
ShadowLeak, which used indirect prompt injections to instruct ChatGPT to exfiltrate data via URL parameters.
In the ShadowLeak proof-of-concept (PoC) attack, ChatGPT would append the data to the end of a link to an attacker-controlled domain, causing the attacker to receive the data when the crafted URL was accessed by the AI or browser.
OpenAI fixed this previous issue by preventing ChatGPT from modifying URLs. However, Radware managed to bypass this fix in their latest PoC, by providing a series of pre-constructed URLs in malicious instructions to the AI.
Instead of asking ChatGPT to create a URL with certain parameters, the attacker would provide separate pre-made, attacker-controlled URLs for each letter, number and special character that could be used to reconstruct the targeted data piece by piece.
For example:
https[:]//compliance[.]hr-service[.]net/get-public-joke/a
https[:]//compliance[.]hr-service[.]net/get-public-joke/b
https[:]//compliance[.]hr-service[.]net/get-public-joke/c
etc.
In an email sent to the victim, the attacker would provide this full series of URLs and instruct the AI to retrieve sensitive data, normalize it by making all letters lowercase and replacing spaces with a special character (such as $) and open, in order, the URLs corresponding to the characters contained in the normalized string (or output them as Markdown images).
The researchers further provided numbered versions for each URL to ensure sensitive data such as phone numbers and passwords could be transmitted in their precise order (ex. /a1, /a2, /a3 etc.) The malicious instructions and list of URLs could be hidden from the user through the use of white-on-white text or extremely small font sizes.
Because this attack did not require ChatGPT to create its own URLs and instead visit pre-existing links, it effectively circumvented the previous fix for ShadowLeak, Radware reported.
Following a report by Radware submitted via BugCrowd, OpenAI fixed this issue on Dec. 16, 2025, by preventing ChatGPT from following links originating from emails unless they appeared in well-known public indexes or were provided by the user themselves, Pascal Geenans, vice president of threat intelligence at Radware, told SC Media.
“OpenAI indicated that additional protections were added but did not share further technical details. Radware verified that the attack chains described in the research no longer work following these changes,” Geenans said in an email.
‘ZombieAgent’ attack leveraged Memory feature for persistence
Radware’s research detailed an attack chain, dubbed ZombieAgent, that relied on the use of Connectors for indirect prompt injection and abused ChatGPT’s Memory feature for persistence.
Connectors is an optional feature that allows ChatGPT to connect to external services such as Gmail, Outlook, Google Drive, GitHub and more. The Memory feature, which is optional but enabled by default, stores specific information from conversations that can be referenced across other ChatGPT conversations.
As with
similar indirect prompt injection techniques, including ShadowLeak, the ZombieAgent attack would begin with an attacker hiding malicious instructions in emails sent to the victim or files shared with the victim through their connected services.
These instructions would prompt ChatGPT to store additional malicious instructions as a Memory, ensuring they can be referenced during any future chat, including when a new chat is created. These additional instructions tell the AI to find an email or file from the attacker containing the final instructions aimed at data exfiltration.
Following a prompt by the victim, ChatGPT would access the Memory, find the specified email or file, follow these instructions to retrieve sensitive data from conversations or Connectors, and exfiltrate it by visiting a series of pre-constructed URLs, as described above.
While the data exfiltration method that enabled ZombieAgent has now been fixed, Geenans said that organizations should remain vigilant of prompt injections risks as attackers find creative ways to circumvent guardrails.
“Guardrails should not be considered fundamental solutions for the prompt injection problem; instead, they are a quick fix to stop a specific attack vector. As long as there is no fundamental solution, prompt injection will remain an active threat and real risk for organizations deploying AI assistants and agents,” Geenans said in a statement provided to SC Media.
