ShadowLeak: Zero-Click, Server-Side Theft from ChatGPT Deep Research
The victim never opens the email. The agent does — from OpenAI's own servers — and quietly mails your inbox out.
| When | September 2025 |
|---|---|
| Target | ChatGPT Deep Research (Gmail connector) |
| Researchers | Radware (Babo, Nakibly, Uziel) |
| Technique | Zero-click, server-side indirect prompt injection |
| Status | No CVE (service-side fix); OpenAI resolved 3 Sep 2025 |
- 1A poisoned email with hidden white-on-white instructions sits in the inbox
- 2ChatGPT's Deep Research agent processes the Gmail-connected inbox
- 3It base64-encodes personal data and appends it to an attacker URL it fetches server-side
What happened
In 2025, Radware disclosed ShadowLeak: a zero-click data-exfiltration attack on ChatGPT's Deep Research agent when connected to Gmail. A poisoned email, with instructions hidden in white-on-white or microscopic text, simply had to arrive in the inbox. When the agent later processed the mailbox, it leaked personal data. OpenAI fixed it server-side and marked it resolved in September 2025; no CVE was assigned.
How the attack worked
The hidden instructions told the agent to base64-encode inbox contents and append them to an attacker-controlled URL, which the agent then fetched. Crucially, that fetch happened from OpenAI's cloud infrastructure — not the user's browser or network — so no endpoint or network monitoring saw the leak.
First server-side agent exfilRadware billed it as the first zero-click leak that originates entirely from the AI provider's cloud, leaving no client-side trace.
Root cause
The agent read untrusted email as instructions and could make arbitrary outbound requests server-side — combining an injection surface with an invisible exfiltration channel.
Why it matters
Agentic assistants that autonomously read mail and browse the web can be attacked with content that merely sits in an inbox — and the exfiltration may be invisible to every defence you control.
How to prevent it
- Strip hidden/obfuscated text before an agent ingests content.
- Separate 'read my mailbox' from 'make web requests' as distinct capabilities.
- Constrain and log agent egress server-side, where the leak actually happens.
Feel it yourselfThe replay lab recreates the exfiltration channel — get an assistant to leak its context through an outbound URL.
FAQ
Why is 'server-side' significant?
The agent fetches the exfiltration URL from OpenAI's own infrastructure, not the user's browser or network. Endpoint and network defences see nothing — the data leaves from the cloud, which Radware billed as the first zero-click service-side agent exfiltration.
How is it zero-click?
The malicious email just needs to arrive. The victim never opens or clicks it; the agent encounters it while doing routine inbox research and acts on the hidden instructions.
How do you defend?
Strip hidden/obfuscated text before agent ingestion, constrain and log the agent's outbound network calls, and separate 'read my mailbox' from 'make arbitrary web requests' as capabilities.
Sources
- ShadowLeak: Zero-Click Data Exfiltration from ChatGPT Deep Research — Radware Threat Intelligence
- OpenAI fixes zero-click 'ShadowLeak' vulnerability — The Record