Disclosed vulnerability
SpAIware: spyware injected into ChatGPT long-term memory for persistent exfiltration
AIR-2024-0041 AIR record · 2024-09-openai-chatgpt-spaiware
From the supporting source
Since the malicious instructions are stored in ChatGPT's memory, all new conversation going forward will contain the attackers instructions.embracethered.com
The record
Disclosed
2024-09-20
Vendor
OpenAI
Product
ChatGPT macOS app
Risk domain
Privacy › Data exfiltration channels
Also touches
Data and memory poisoning, Confused deputy
System type
Generative model
Who acted
Agent acted — the assistant wrote spyware to memory and exfiltrated on later turns
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document web
Impact type
Persistent memory poisoning, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ChatGPT macOS users with memory enabled
Capability abused
Defense & remediation
Recorded defense
client-side URL validation (url_safe), bypassed
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
fixed in ChatGPT version 1.2024.247 (September 2024); the underlying memory-injection issue remained
Taxonomy & references
Curator notes
Johann Rehberger. The canonical demonstration that agent memory turns a one-shot injection into persistence.
Supporting sources
Cite as
Enkrypt AI. "SpAIware: spyware injected into ChatGPT long-term memory for persistent exfiltration". AIR, AIR-2024-0041. https://agentincident.vercel.app/i/AIR-2024-0041/ (accessed 2026-10-19).