ChatGPT Deep Research Agent Exposes Gmail Data via ShadowLeak Flaw

Published: Sep 20, 2025 | Author: Ravie Lakshmanan | Category: Artificial Intelligence / Cloud Security

Cybersecurity researchers at Radware have uncovered a critical zero-click vulnerability in OpenAI ChatGPT's Deep Research agent, dubbed ShadowLeak, which allows attackers to exfiltrate sensitive Gmail inbox data with a single crafted email—requiring no user interaction.

How ShadowLeak Works

The attack exploits indirect prompt injection, where malicious instructions are hidden in email HTML (e.g., tiny fonts, white-on-white text, or CSS tricks). When the victim uses ChatGPT Deep Research to analyze their Gmail, the agent reads and executes these hidden commands, exfiltrating data to an attacker-controlled server.

• No user action needed: The flaw is triggered automatically when the agent processes the email.
• Bypasses traditional defenses: Data exfiltration occurs directly from OpenAI's cloud infrastructure, evading local or enterprise security tools.
• Broad attack surface: While demonstrated with Gmail, the flaw could affect other ChatGPT connectors like Microsoft Outlook, Dropbox, and GitHub.

Key Takeaways

1. Responsible Disclosure: Radware reported the issue to OpenAI on June 18, 2025, and a patch was deployed in early August 2025.
2. Unique Cloud-Based Exfiltration: Unlike client-side attacks (e.g., AgentFlayer or EchoLeak), ShadowLeak operates entirely within OpenAI's cloud, making detection harder.
3. Base64 Encoding: Attackers instructed the agent to encode stolen data in Base64 before exfiltration, framing it as a "security measure."