ChatGPT falls to new data pilfering attack as a vicious cycle in AI continues

There’s a familiar pattern in AI chatbot security: researchers uncover a vulnerability, a guardrail is added, and a small tweak revives the attack. In this case, a vulnerability in ChatGPT allowed Radware researchers to exfiltrate a user’s private information and even send data from ChatGPT servers, giving the breach extra stealth since many affected users sit inside protected enterprises.

The attack persisted by embedding instructions into a user’s long-term memory, enabling persistence, and it’s part of a broader class known as indirect prompt injection or prompt injection. ShadowLeak, a previous data-exfiltration vulnerability in ChatGPT disclosed last September, was followed by a revised attack dubbed ZombieAgent, which uses a character-by-character exfiltration technique and indirect link manipulation to bypass guardrails.

OpenAI responded by restricting how ChatGPT opens URLs and the parameters it can append, but Radware’s tweak showed the attack can be revived with simple prompt adjustments. OpenAI has since limited opening links to well-known public indices or user-provided prompts, and Radware’s report says guardrails are quick fixes rather than fundamental solutions, according to Radware.

The story underscores the ongoing cycle as attackers repeatedly adapt to defender updates, with researchers emphasising that the root cause lies in the difficulty of separating valid instructions from malicious prompts. The article is by Dan Goodin, dated 8 January 2026.