HackedGPT: New Vulnerabilities in GPT Models Allow Attackers to Launch 0-Click Attacks

Cybersecurity researchers have uncovered seven critical vulnerabilities in OpenAI’s GPT models, including a zero-click attack that can be triggered by asking an innocuous question and a safety-mechanism bypass that uses Bing tracking links. The flaws affect ChatGPT and the latest GPT-5 model, with the memory feature by default storing potentially sensitive information across conversations, enabling persistence of data exfiltration through memory manipulation.

The researchers describe methods to inject malicious prompts through comment sections on trusted websites, indexed pages, and direct URL parameters, including a technique called “Conversation Injection” that can prompt ChatGPT to inject itself. A notable risk is exfiltration of user data one character at a time via Bing’s allowed status, bypassing the url_safe endpoint. There is also a documented markdown rendering bug that hides malicious content while processing user data, making attacks harder to detect.

In demonstrations, attackers could spray malicious prompts on blogs and news sites, provoking ChatGPT to summarise content and trigger data theft or phishing, with zero user interaction required beyond asking a question, according to Tenable.