0-Click ChatGPT Agent Flaw Exposes Gmail Data to Attackers

Researchers have identified a critical zero-click flaw in ChatGPT’s Deep Research agent that can silently exfiltrate Gmail data without any user interaction, according to Radware. The attack uses service-side exfiltration techniques, operating entirely within OpenAI’s cloud infrastructure and making it nearly invisible to traditional security controls.

The procedure begins when an attacker sends a seemingly innocuous email containing hidden HTML instructions that direct the agent to locate sensitive information and transmit it to an attacker-controlled server. When users later ask the Deep Research agent to analyse their emails, it is claimed to execute these malicious instructions, enabling data theft. The piece notes that the attackers can encode stolen data in Base64 during transmission, a method that purportedly evades some safety checks in transit.

Researchers are quoted as saying the approach represents a dangerous evolution, with the flow occurring from OpenAI’s trusted servers rather than user devices, creating a significant blind spot for organisations using ChatGPT’s Deep Research with email access. The article, dated 19 September 2025, also reports a 100% success rate in their tests under crafted social engineering.