ChatGPT Deep Research Targeted in Server-Side Data Theft Attack

Researchers at web security company Radware described a zero-click server-side data theft technique dubbed ShadowLeak that targeted ChatGPT’s Deep Research capability. According to Radware, the attack did not require user interaction and relied on a specially crafted email processed by the Deep Research agent to quietly collect data and send it to the attacker, with exfiltration occurring via a request to an attacker-controlled URL.

Unlike client-side attacks, ShadowLeak operates in OpenAI’s cloud infrastructure, meaning the leak originates from OpenAI’s servers. Radware notes that prior theoretical attacks have involved enterprise-tool integrations, but ShadowLeak entails server-side activity and thus leaves fewer traces in the ChatGPT client. OpenAI neutralised ShadowLeak after Radware notified them, with the vulnerability fixed in early August, and Radware says there remains a sizeable threat surface yet undiscovered.

The attack paper mentions that Deep Research can access services beyond Gmail, including Google Drive, Dropbox, Outlook, HubSpot, Notion, Microsoft Teams, and GitHub.