ChatGPT Targeted: “ShadowLeak” Zero-Click Vulnerability in Deep Research Could Exfiltrate Gmail Data A Complete Cyber Threat Analysis Report — By CyberDudeBivash Author: CyberDudeBivash · Powered by: CyberDudeBivash

Executive summary

Researchers at Radware disclosed ShadowLeak, a zero-click indirect prompt-injection flaw in ChatGPT’s Deep Research agent that, when connected to Gmail (and browsing enabled), could exfiltrate inbox data via a single crafted email—with no user interaction and no visible UI cues. OpenAI confirmed and patched the issue before public disclosure (September 18–20, 2025). The attack is notable for being service-side: data leaves OpenAI’s cloud rather than the user’s device, making enterprise detection far harder. SecurityWeek+3radware.com+3radware.com+3

What is Deep Research and why it was exposed

Deep Research lets users delegate multi-step tasks to an agentic AI that can browse and access connected data sources (e.g., Gmail, Google Drive) to compile findings. The agent will read emails/attachments as part of its task plan. This connective power, combined with prompt-following, makes it high-impact if an attacker can plant hidden instructions the agent will read and obey. Malwarebytes

How ShadowLeak works (at a glance)

Vector: A legitimate-looking email carries hidden instructions (e.g., white-on-white text, tiny fonts, CSS-hidden blocks) that only the agent reads when scanning the inbox.
Exploit: The poisoned content induces the agent to extract sensitive Gmail data (threads, names, addresses, summaries) and exfiltrate it—e.g., by embedding data into a URL fetch or posting to attacker infra.
Zero-click & service-side: The user doesn’t open or click; the agent runs from OpenAI infrastructure, so local controls/EDR don’t see the leak. radware.com+2The Hacker News+2

Conditions required

The user has connected Gmail to ChatGPT (Deep Research/Connectors).
The agent is allowed to browse and process the Gmail inbox as part of its plan.
A crafted email lands in the mailbox (the attack can trigger during routine agent runs). radware.com

Impact & business risk

PII/PHI exposure (names, emails, deal/legal details).
Regulatory exposure (GDPR/CCPA/SEC), reputational harm, potential downstream fraud.
Detection gap: Because the leak occurs server-side, SOC tools watching endpoints/gateways might miss it. radware.com

Incident timeline (IST; September 2025)

Sep 18, 2025: Radware publishes ShadowLeak details and advisory; OpenAI confirms a fix. radware.com
Sep 19–20, 2025: Trade press & vendors report fix; no evidence of in-the-wild exploitation disclosed. SecurityWeek+2Malwarebytes+2
Sep 20–22, 2025: Wider coverage (EU/US outlets) reiterates zero-click, service-side nature. Cinco Días+1

Technical deep dive (concise)

Attack class: Indirect Prompt Injection (IPI) via email HTML.
Execution flow: Deep Research → reads inbox → parses HTML → hidden prompt triggers goal re-write (“exfiltrate summary/headers/threads to URL X”).
Exfil path: Outbound requests from OpenAI servers (e.g., image loads/HTTP calls) carrying sensitive data in query strings/headers/body.
Defense challenge: Classic mail gateways don’t see agent-side behavior; endpoint EDR won’t see cloud egress. radware.com+1

Detection ideas (what blue teams can do now)

Review ChatGPT account integrations: enumerate org users who enabled Gmail/Calendar connectors or Deep Research. Log when agents accessed email. SecurityWeek
Look for unusual agent activity: alerts on bulk summaries or uncharacteristic data pulls from mailboxes (audit trails, OAuth access logs).
Outbound anomaly hunting: if you run egress logging for AI connectors (SaaS CASB/SSE), search for high-entropy URL queries or calls to unknown domains shortly after agent runs.
Retrospective check: correlate timestamps of Deep Research tasks with arrival of strange emails (e.g., invisible text, oversized HTML, excessive CSS). The Hacker News

Mitigations & hardening (prioritized)

Immediate (today):

Disable/limit Gmail access for agentic modes unless strictly required; enforce least-privilege scopes. radware.com
Quarantine “invisible-text” emails: raise scores for mails with white-on-white, zero-size fonts, offscreen CSS.
User controls: In Google settings, restrict Calendar/Email auto-ingestion to known senders; consider disconnecting connectors not in use. Tom’s Hardware
Confirm OpenAI patch is active; monitor vendor bulletins for further mitigations. The Record from Recorded Future

Short term (this week):

Policy gates: Require human-in-the-loop approval before agents can read personal mailboxes or export content outside the tenant.
Output filtering: Block agent-initiated external fetches containing mailbox tokens/strings; sanitize URLs constructed by agents.
Prompt hardening: Add system prompts/guardrails that forbid data exfiltrations and penalize obeying hidden/invisible content. (Not bulletproof, but raises effort.) CSO Online

Longer term:

Model-side injections defense: deploy content provenance checks and HTML sanitization for agent inputs; maintain deny-lists for exfil patterns.
SaaS CASB/SSE with LLM/agent telemetry; require signed connector actions and per-action user consent for sensitive scopes.
Red-team scenarios: include zero-click IPI tests against connected data sources (Gmail/Drive/Calendar). WIRED

Frequently asked (fast answers)

Was this exploited in the wild? No public evidence so far; OpenAI fixed before widespread abuse was reported. Malwarebytes+1
Who’s affected? Users who connected Gmail and ran Deep Research with browsing; other connectors could be conceptually at risk. radware.com
Why didn’t our tools see it? The leak happened server-side from OpenAI, bypassing endpoint/network sensors. radware.com

CyberDudeBivash action checklist

Inventory who enabled Gmail/Calendar connectors or Deep Research in your org. SecurityWeek
Temporarily limit agent access to personal mailboxes; require approvals for mailbox reads. radware.com
Add mail-content detections for invisible/hidden text patterns.
Block/inspect agent external fetches that embed mailbox data.
Run a tabletop on zero-click IPI against AI connectors; brief execs on legal/compliance exposure. WIRED

Conclusion

ShadowLeak is a watershed: it shows how agentic AI + powerful connectors can be turned against users in zero-click, server-side ways traditional defenses won’t see. OpenAI’s fix reduces immediate risk, but organizations must treat AI connectors as high-risk integrations—with least-privilege scopes, human-in-the-loop controls, and new detections purpose-built for prompt-injection and service-side exfiltration. radware.com

Affiliate Toolbox (clearly disclosed)

Disclosure: If you buy via the links below, we may earn a commission at no extra cost to you. These items supplement (not replace) your security controls. This supports CyberDudeBivash in creating free cybersecurity content.

🚀 Learn Cybersecurity & DevOps with Edureka

🌐 cyberdudebivash.com | cyberbivash.blogspot.com#CyberDudeBivash #ShadowLeak #ChatGPT #DeepResearch #PromptInjection #ZeroClick #Gmail #AIAgents #CloudSecurity #ThreatIntel #Infosec

Cyberdudebivash