AI Security Breach: ShadowLeak Exposes OpenAI’s Invisible Email Threat!
Researchers at Radware have uncovered a flaw in OpenAI’s ChatGPT Deep Research tool that allows hackers to swipe data like a sneaky ninja in a zero-click attack. Dubbed ShadowLeak, this service-side exfiltration operates right under users’ noses, making it a perfect candidate for the “Most Inconvenient Data Breach” award.
Hot Take:
Well, it seems like AI has taken a page from Houdini’s book: now you see your data, now you don’t! Thanks to a sneaky vulnerability known as ShadowLeak, it turns out your AI buddy might just be moonlighting as a magician for the cybercriminals, pulling your emails out of their hat without a single click from you. Magic? More like tragic!
Key Points:
- Radware discovered a vulnerability in OpenAI’s ChatGPT Deep Research agent called ShadowLeak.
- ShadowLeak is a zero-click attack embedded in emails, leading AI to leak private data.
- This attack uses a method known as indirect prompt injection.
- The flaw was responsibly reported to OpenAI and fixed by early August 2025.
- Similar attacks could potentially target other services linked with the AI tool.
Already a member? Log in here