Access
ShadowLeak: ChatGPT's research agent leaked data from Gmail
In September 2025 Radware showed how an email with hidden instructions could make ChatGPT's Deep Research agent send personal data from a mailbox to an outside address, straight from OpenAI's servers.
Deep Research, which OpenAI introduced in February 2025, is an AI agent that works on its own: at the user's request it searches the web or, if connected, the user's mailbox, and writes a detailed report. On 18 September 2025 the security company Radware disclosed a flaw in it that required no action from the user. It named the attack ShadowLeak.
The attacker sent an email whose code contained instructions hidden from the reader, in tiny type or as white text on a white background. They told the agent to collect personal data from the mailbox and send it to an address given by the attacker; the text used false claims of authority and a sense of urgency to get past the agent's safety checks. When the user later asked the agent to go through their emails, it read this message too, followed the instructions and sent off data such as names and addresses, without asking for confirmation.
What set it apart, according to Radware, was that the data left not from the user's computer but directly from OpenAI's cloud, so neither the user's nor the organisation's security tools could see anything. Radware said the method could also have worked with Deep Research's other connections, such as Google Drive, Dropbox, SharePoint, Outlook or Teams. It reported the flaw on 18 June; OpenAI fixed it in early August and marked it resolved on 3 September. OpenAI did not answer The Register's question about whether it had been exploited.
What can we learn from it?
The more an AI agent can reach – emails, documents, the web – the more chances a stranger has to steer it with text sent its way; and when the leak happens in the provider's cloud, our own defences cannot see it. Agents can still be useful when their access fits the task. In Confiella the model has no access to email, files or the web: it only receives the request the user has reviewed and approved. Give other agents a separate mailbox or folder, and connect client correspondence only when the task truly needs it.
Sources
- Security Affairs: ShadowLeak: Radware Uncovers Zero-Click Attack on ChatGPT
- The Register: OpenAI plugs ShadowLeak bug in ChatGPT that let miscreants raid inboxes
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]