- ID
- AIA-015
- Category
- AI AI agent incident
- Disclosed
- 2025-02
- Systems
- ChatGPT Operator
- Harm type
- Prompt injection / data leak
- Status
- reported
Reported by the source; no vendor fix statement recorded.
Summary
Rehberger reported that a prompt injection could make OpenAI's Operator browse to sites where the user was logged in and leak personal profile information "like email address, home address, and phone number." He also describes OpenAI's mitigations, such as user monitoring and confirmations.
Controls
Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.
NIST AI RMF
- MEASURE 2.7 Security and resilience are evaluated and documented
- MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system
NIST SP 800-53
Human-approval (JCR) checkpoint
partial: confirmations on agent actions, which typing text rarely triggered
Sources
- embracethered.com primary link checked 2026-10-31, HTTP 200
Post dated Feb 17, 2025
https://embracethered.com/blog/posts/2025/chatgpt-operator-prompt-injection-exploits/
Corrections
No corrections recorded.
To report an error in this entry, see corrections.