Researchers Hack ChatGPT Memories and Web Search Features

Tenable researchers disclosed seven new ChatGPT vulnerabilities and attack techniques that could facilitate data theft and other malicious activity. The flaws involve several features, including the bio or memories function, which lets ChatGPT recall user details across chats, and the open_url command that uses SearchGPT to browse the web and relay findings to ChatGPT.

Researchers showed that the url_safe endpoint is prone to manipulation and that a summarisation of a site can cause SearchGPT to execute prompts injected into a site’s comments, enabling prompt injection. They also demonstrated that ChatGPT relies on Bing and OpenAI’s crawler for searches, meaning attackers can create a malicious or misleading site that appears in results and is processed by SearchGPT.

In experiments, a deliberately set up “malicious” site led to an injected prompt when users queried about a topic, and a Bing URL could bypass the url_safe check to exfiltrate data or guide users to phishing sites. OpenAI has been informed and patched some of the issues, but Tenable notes that prompt injection remains a persistent security challenge for large language models, with some methods still viable against GPT-5.