ShadowLeak: Radware Uncovers Zero-Click Attack on ChatGPT

Radware has uncovered a server‑side data theft attack dubbed ShadowLeak that targets ChatGPT. The researchers say the attack exploits a zero‑click vulnerability in ChatGPT’s Deep Research agent when it is connected to Gmail and browsing, allowing the agent to leak sensitive inbox data to an attacker with no user action or visible UI.

According to Radware, the exfiltration occurs entirely from OpenAI’s cloud infrastructure, via an indirect prompt injection hidden in email HTML that the agent reads and obeys, enabling data to be sent to an attacker‑controlled URL without detection by local or enterprise protections. The attack flow involves convincing emails that embed instructions to extract PII and call a malicious URL, using social‑engineering tactics to bypass safety checks and rely on real data in the mailbox.

The researchers note that the PoC used Gmail, but the flaw can affect any connector feeding text to the agent, including Drive, Dropbox, SharePoint, Outlook, Teams, GitHub, and similar services. Mitigations suggested include sanitising email prior to ingestion and implementing continuous agent behaviour monitoring to detect deviations from legitimate intent.