AIA-016 "ShadowLeak": zero-click service-side exfiltration via ChatGPT Deep Research, per Radware

ID: AIA-016
Category: AI AI agent incident
Disclosed: 2025-09
Systems: ChatGPT Deep Research (Gmail connector)
Harm type: Prompt injection / data leak
Status: fixed
Radware's timeline: fixed in early August 2025; OpenAI acknowledged the vulnerability and marked it resolved on September 3, 2025.

Summary

Radware reported that a crafted email could make ChatGPT's Deep Research agent, when connected to Gmail, "leak sensitive inbox data to an attacker with no user action or visible UI." Radware says it reported the issue on June 18, it was fixed in early August, and OpenAI marked it resolved on September 3.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MEASURE 2.7 Security and resilience are evaluated and documented
MANAGE 4.1 Post-deployment monitoring is in place

NIST SP 800-53

AC-4 Information Flow Enforcement
SI-10 Information Input Validation
SI-4 System Monitoring

Human-approval (JCR) checkpoint

yes: outbound requests to attacker-controlled URLs

Sources

radware.com primary link checked 2026-10-31, HTTP 200
Post dated September 18, 2025. Page needs JS; content read via Firecrawl.
https://www.radware.com/blog/threat-intelligence/shadowleak/

Corrections

No corrections recorded.

To report an error in this entry, see corrections.