Research demo
ChatGPT Custom Instructions used as a persistent data exfiltration backdoor
AIR-2023-0017 AIR record · 2023-07-openai-custom-instructions-backdoor
From the supporting source
More and more plugins are taking a dependency on this insecure behavior for rendering images for instance, which will make a fix quite difficult for OpenAI the longer they wait.embracethered.com
The record
Disclosed
2023-07-24
Vendor
OpenAI
Product
ChatGPT Custom Instructions
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels
System type
Generative model
Who acted
Agent acted — the assistant rendered exfiltration images from persisted custom instructions
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Prompt injection custom instructions
Impact type
Data exfiltration, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ChatGPT users whose custom instructions were modified
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
not fixed at publication; the underlying image-markdown exfiltration was reported to OpenAI in April 2023
Taxonomy & references
Curator notes
Johann Rehberger. First persistence primitive in ChatGPT, predating the memory feature.
Supporting sources
Cite as
Enkrypt AI. "ChatGPT Custom Instructions used as a persistent data exfiltration backdoor". AIR, AIR-2023-0017. https://agentincident.vercel.app/i/AIR-2023-0017/ (accessed 2026-10-19).