ChatGPT Deep Research zero-click vulnerability fixed by OpenAI

OpenAI has patched a vulnerability dubbed ShadowLeak in its ChatGPT Deep Research project, which researchers disclosed yesterday. The zero-click flaw could be exploited by sending a specially crafted email to a target, leaking sensitive inbox information without the user taking any action. The attack relied on prompt injection, with poisoned prompts hidden in email text using tricks such as tiny fonts or white-on-white layouts, and the data leak occurred server-side from OpenAI’s cloud infrastructure.

Researchers showed that the exploit could succeed by having the agent encode extracted PII with base64 before appending it to a URL, making the encoded string appear harmless to lower layers. Deep Research, launched in early 2025 to enable autonomous agent-based multi-step research, was touted as having this vulnerability fixed, according to OpenAI.