{
 "public_id": "AIR-2025-0133",
 "incident_id": "2025-09-openai-chatgpt-custom-mcp-calendar-exfil",
 "date_disclosed": "2025-09-13",
 "date_occurred": null,
 "title": "ChatGPT + custom MCP: a malicious calendar invite makes the agent email the victim's inbox to the attacker, disguising the approval prompt",
 "class": "research_demo",
 "attack_surface": "mcp_server",
 "initial_vector": "indirect_prompt_injection_calendar_invite",
 "agent_capability_abused": [
  "mcp_tool_invocation",
  "email_send",
  "calendar_read"
 ],
 "target_product": "ChatGPT with custom MCP connectors (Zapier Gmail)",
 "target_vendor": "OpenAI",
 "autonomy_level": "copilot_with_approval",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration"
 ],
 "blast_radius": "ChatGPT users with write-enabled custom MCP connectors",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "indirect_prompt_injection",
   "approval_prompt_spoofing",
   "write_scoped_connector",
   "lethal_trifecta"
  ]
 },
 "defense_present": "human approval step before tool execution",
 "defense_bypassed": true,
 "fix_shipped": "unfixed; mitigations recommended but not default",
 "primary_sources": [
  "https://promptarmor.substack.com/p/chatgpt-custom-mcp-data-exfiltration"
 ],
 "verified_quote": "Because the attacker in the calendar invite asked the LLM to only ask the user 'Would you like me to help you prepare for it' for the approval step instead of actually describing what it does — the LLM follows that instruction and the user really doesn't know what they are approving.",
 "confidence": "high",
 "notes": "PromptArmor, demonstrated 2025-09-12. The interesting primitive is approval-prompt content being attacker-controlled: the human is in the loop but is shown a benign description of a malicious action. Related to but distinct from 2025-08-google-gemini-calendar-promptware and 2026-01-google-gemini-calendar-invite-leak.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "Data Exfiltration via Context",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent read the invite and emailed the inbox to the attacker",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_calendar_invite",
 "guardrail_kind": [
  "human_approval"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "openai",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "subcategory: Data Exfiltration via Context",
 "asi_curated": [
  "ASI01",
  "ASI03"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated",
 "asi_reason": "curated: ASI01,ASI03",
 "submitted_by": "EAI Internal"
}