ShadowLeak Zero-Click Flaw Leaks Gmail Data via OpenAI ChatGPT Deep Research Agent

ShadowLeak is a zero-click flaw in OpenAI ChatGPT's Deep Research agent that could allow an attacker to leak Gmail inbox data with a single crafted email and no user action. The attack, codenamed ShadowLeak by Radware, was disclosed on 18 June 2025 and addressed by OpenAI in early August 2025, according to Radware.

It relies on indirect prompt injection hidden in email HTML—tiny fonts, white-on-white text, or layout tricks—so the commands go unnoticed while the agent still reads and obeys them, the researchers said. Unlike prior client-side attacks, the leakage occurs directly from OpenAI's cloud infrastructure, which can bypass local or enterprise security controls.

The PoC hinges on users enabling the Gmail integration, but the attack could extend to other connectors that ChatGPT supports, broadening the potential attack surface.