Hackers Exploit SSRF Flaw in Custom GPTs to Steal ChatGPT Secrets

A cybersecurity researcher uncovered a server-side request forgery (SSRF) flaw hidden in OpenAI’s ChatGPT Custom GPTs feature, which could have allowed attackers to access sensitive cloud infrastructure secrets, including Azure management API tokens. Disclosed through OpenAI’s bug bounty program, the issue was patched rapidly, underscoring the persistent dangers SSRF poses to cloud-based AI services.

The attacker could exploit the GPT’s Ability to fetch data from user-specified URLs by bypassing HTTP/HTTPS and, in Azure, target the instance metadata service at endpoints like http://169.254.169[.]254 to obtain metadata and credentials. In a demonstrated bypass, a 302 redirect was used to reach the internal IMDS, and a crafted header injection enabled access to IMDS data, potentially yielding an OAuth2 token for Azure’s management API (resource: https://management.azure[.]com/, API version: 2025-04-07).

OpenAI patched the flaw, likely tightening URL validation, redirect handling, and header controls, a reminder that even helpful features can broaden attack surfaces in cloud-integrated AI. According to OpenAI’s bug bounty program, mitigations are aimed at preventing similar exfiltration of infrastructure secrets in the future.