AIA-024 "AgentFlayer": zero-click data exfiltration via ChatGPT Connectors, per Zenity Labs

ID: AIA-024
Category: AI AI agent incident
Disclosed: 2025-08
Systems: ChatGPT Connectors
Harm type: Prompt injection / data leak
Status: reported
Reported by the source; no vendor fix statement recorded.

Summary

Zenity Labs reported that a poisoned document could make ChatGPT with Connectors exfiltrate data such as API keys from Google Drive, using an image URL that got past OpenAI's client-side URL-safety check. Zenity writes: "ChatGPT is very comfortable rendering images which are hosted by Azure Blob."

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MEASURE 2.7 Security and resilience are evaluated and documented
MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system

NIST SP 800-53

AC-4 Information Flow Enforcement
SI-10 Information Input Validation

Human-approval (JCR) checkpoint

not applicable

Sources

labs.zenity.io primary link checked 2026-10-31, HTTP 200
Post dated Aug 6, 2025
https://labs.zenity.io/p/agentflayer-chatgpt-connectors-0click-attack-5b41

Corrections

No corrections recorded.

To report an error in this entry, see corrections.