Someone sends you an e-mail. You never open it. Later you ask ChatGPT to go through your inbox and summarise the week. The agent opens it for you, finds an instruction written in white text on a white background, and does what it says — with every system you have connected.
That is ShadowLeak, found by researchers at Radware and reported to OpenAI privately through its bug bounty programme. OpenAI fixed it before the write-up was published, and there is no evidence it was ever used against real users. It is worth understanding anyway, because the bug is gone and the shape of the problem is not.
How it worked
The target was ChatGPT's Deep Research agent — the mode that goes off and reads things on your behalf rather than answering from what it already knows. The attack has three moves, and the victim participates in none of them.
- A message carries instructions the human cannot see. Hidden inside the markup of an ordinary-looking e-mail: white on white, one-pixel type, a footer nobody scrolls to. To the reader it is a dull newsletter. To an agent reading the raw message, it is a paragraph of orders.
- The agent reads the mailbox and obeys. Not because it was tricked into believing something false, but because a language model has no reliable way to tell the difference between the content it was asked to read and an instruction about what to do. The mail says, in effect: while you are here, collect the personal details in this inbox.
- The data leaves inside a URL. The instructions tell the agent to Base64-encode what it found, append it to an address the attacker controls, and fetch that address — dressed up as a routine lookup the user supposedly asked for.
The part that made it different
Plenty of prompt-injection demos end with data leaving through the user's browser. This one did not. Radware's description of it:
The web request is performed by the agent executing in OpenAI's cloud infrastructure, causing the leak to originate directly from OpenAI's servers.
So the request never touched the victim's machine or the company's network. There was nothing for a firewall to block, nothing for a secure web gateway to log, nothing for an endpoint agent to notice. From inside the customer's own security stack, the incident is invisible: the traffic that carried the data out was between OpenAI and a stranger. Radware reported a 100% success rate at pulling Gmail data in their proof of concept.
Why the blast radius is the real story
The demonstration used Gmail. The reason it mattered is the list of everything else it could have used. A Deep Research agent acts with whatever its owner has connected, and the connector list is the modern back office: Gmail, Google Drive, Dropbox, Outlook, HubSpot, Notion, Microsoft Teams, GitHub.
One hidden paragraph in one e-mail inherited all of it at once. Not because any individual permission was wrong — the user really does have access to their own mail, their own Drive, their own repositories — but because the agent was granted the person, not the task. Nothing in the chain ever asked the narrower question: for this piece of work, what is the least this thing needs to see?
The lesson
If an agent holds a person's full access, then anything that agent reads can spend it. Content becomes instructions, and every connector is in range at once.
What actually helps
Not banning it. A ban moves the same behaviour to a personal account on a personal laptop, where you will not hear about it at all. The things that reduce this class of problem are unglamorous:
- Scope per caller, not per integration. An assistant holding one shared integration credential reaches everything that credential reaches, no matter who is asking. One that calls as a person, under that person’s roles, reaches what they reach and no more — so an injected instruction inherits their limits instead of the integration’s. Least privilege is boring and it is the whole defence.
- Filter on the way out, not on the way in. Rows and fields a role is not entitled to should never be in the answer to be exfiltrated. Redacting after the fact is a promise; not sending is a property.
- Log every call, on your side of the line. ShadowLeak's cruelty was that the customer's own telemetry could not see it. A gate that records who asked, which system answered, which fields came back and what was held is evidence you own — not a vendor's word about a period you cannot inspect.
- Assume content is hostile. Any text an agent ingests — a mail, a ticket, a PDF, a README — is attacker-controlled the moment anyone outside can write it. The boundary that matters is not "is this model clever enough to spot the trick", it is "what can it reach if it falls for one".
Radware's own closing note is the right one to sit with: the specific hole is closed, but in their words, "there is still a fairly large threat surface that remains undiscovered." The bugs will keep arriving. What you get to decide in advance is how much any one of them is worth.