‘ZombieAgent’ Attack Let Researchers Take Over ChatGPT

SecurityWeek reports that the so‑called “ZombieAgent” attack allows researchers to bypass ChatGPT protections and exfiltrate user data while embedding a persistent logic into the agent’s long‑term memory. Widely used across enterprises, ChatGPT has access to internal apps and stores conversations and sensitive information by default, raising the stakes for any exploitation.

According to Radware, the indirect prompt injection technique can be delivered via malicious emails and files to force data leakage and turn the AI into a persistent spy tool for attackers. The first scenario involves an attacker exfiltrating sensitive data through OpenAI’s private servers by sending an email with malicious instructions, which the agent follows when asked to perform a Gmail action, exfiltrating data before the user sees it.

A second scenario relies on instructions in a shared file, while the third and fourth describe propagation to recent addresses and a memory‑modification rule that makes the agent read and execute attacker commands every time a user messages it. Radware says a fix was released on 16 December. January 9, 2026.