ShadowLeak: Zero-Click Gmail Theft via ChatGPT Deep Research Agent
A hidden prompt in an email made OpenAI's ChatGPT Deep Research agent collect inbox data and exfiltrate it from OpenAI's own cloud — a service-side, zero-click leak invisible to local or enterprise defenses.
What happened
Radware disclosed ShadowLeak in September 2025 — a zero-click vulnerability in OpenAI’s ChatGPT Deep Research agent when connected to Gmail. An attacker emails the victim a message with hidden instructions (white-on-white text, microscopic fonts). Later, when the user asks Deep Research to do something ordinary — “summarize today’s emails,” “research my inbox” — the agent ingests the booby-trapped message and, without any further interaction, collects private data and exfiltrates it by calling an attacker-controlled URL.
What made ShadowLeak notable is that the exfiltration is service-side — the data leaves from OpenAI’s own cloud infrastructure, so it is invisible to endpoint or enterprise network defenses. The technique generalizes to any connector Deep Research supports (Drive, Outlook, SharePoint, Notion, and more). OpenAI remediated it after responsible disclosure.
Why it maps to ATLAS
- AML.T0051.001 — LLM Prompt Injection: Indirect: instructions arrive inside a retrieved email.
- AML.T0085.001 — Data from AI Services: AI Agent Tools (Collection): the agent gathers inbox data via its connector.
- AML.T0086 — Exfiltration via AI Agent Tool Invocation: the agent’s own action ships the data to the attacker URL.
Detection notes
Service-side exfiltration defeats local telemetry, so detection has to live where the agent runs: audit connector reads and outbound URLs from the agent runtime, and neutralize instructions in retrieved content before the agent can act on them. Constrain agent egress so a “summarize my inbox” task can’t reach an arbitrary external endpoint with data in the URL.
Detection
Log sources
- Agent connector access logs (Gmail/Drive/etc.)
- Service-side tool-invocation + egress traces
- Inbound mail with hidden HTML (white-on-white, microscopic fonts)
Signals
- Hidden instructions in email HTML processed during 'summarize my inbox' tasks
- Agent calling an external URL with private data in parameters
- Exfiltration originating server-side, absent from endpoint telemetry
Mitigations
- Neutralize instructions in retrieved content before the agent acts
- Constrain agent egress; block data-bearing outbound URLs
- Least-privilege connectors; audit service-side agent actions