'ShadowLeak' ChatGPT Attack Allows Hackers to Invisibly Steal Emails

ShadowLeak is a vulnerability that allows attackers to exfiltrate data from Gmail and other email environments through ChatGPT, with Radware researchers noting there is no trace on the end-user network. The attack works by embedding malicious code in an outwardly normal-looking email, which the AI agent then processes in the cloud when a user asks ChatGPT to summarise their messages.

In testing, ChatGPT could be coaxed into malicious prompts about half the time, and prompts framed as urgent HR checks increased the success rate. The malicious code can instruct the AI to send the victim’s email contents to an attacker-controlled server, meaning sensitive credentials or business information could be exposed without visible signs on the user’s network. Radware reported the issue to OpenAI in June; OpenAI addressed ShadowLeak in August and, according to OpenAI, the fix was confirmed in September.

Pascal Geenens, Radware, emphasises the need for layered safeguards and for using AI tools to detect malicious intent, describing the attack as one that exploits a lack of visibility between requests and responses.