【AIbase Report】According to Radware security researchers, the AI platform ChatGPT had a critical vulnerability called "ShadowLeak" in its "Deep Research" mode. This vulnerability allowed attackers to silently steal sensitive data such as names and addresses from users' Gmail accounts without their knowledge.

The special aspect of this attack is that it occurred entirely within OpenAI's own cloud infrastructure, leaving no traces and bypassing local security protections such as firewalls. Researchers compared this attack method to "an internal employee manipulated from the outside."

Hacker Server Room

It is understood that the attack started with a carefully disguised email, whose subject appeared ordinary, but the email body embedded malicious instructions using hidden HTML (for example, white background with white text or small font). These instructions would trick the "Deep Research" mode agent to perform the following actions: extract personal data from another email of the user. Or send this data to an external URL controlled by the attacker after encoding it with Base64.

To bypass the agent's built-in security measures, attackers used social engineering techniques to make the agent "believe" it had the authority to perform the task and created a sense of urgency with reasons such as "incomplete report." When the user initiated a "Deep Research" query (for example, "analyze my HR emails today"), the agent would unknowingly process the malicious email and execute the hidden instructions, silently transmitting the data to the attacker's server, with the entire process being completely transparent to the user.

Radware pointed out that the vulnerability was not due to the language model itself, but rather the ability of the agent to execute tools. In particular, the internal function named browser.open() allowed the agent to initiate HTTP requests, becoming the breakthrough point for this attack.

Researchers warned that this attack method is not limited to email. Any platform that processes structured text, such as Google Drive, Outlook, Teams, Notion, or GitHub, may face risks. Malicious instructions can be hidden in meeting invitations, shared PDF files, or chat records, turning regular AI tasks into potential security vulnerabilities.

Radware reported the vulnerability to OpenAI through the Bugcrowd platform on June 18, 2025. OpenAI completed the fix in early August, but it wasn't until September 3rd that they publicly acknowledged and confirmed that the issue had been resolved.

This incident once again highlights the vulnerability of AI agent systems. The core issue lies in "Prompt Injection," where attackers embed hidden instructions in text that users are unaware of. Although this vulnerability has existed for years, there is still no reliable solution. Studies show that almost every AI agent could be compromised, especially those that can access the internet, which are easily manipulated, leading to data leaks or malware downloads. OpenAI CEO Sam Altman has also warned not to delegate high-risk or sensitive tasks to AI agents.