Research demo
ChatGPT Operator hijacked by a GitHub issue to exfiltrate PII from authenticated Hacker News and Booking.com sessions
AIR-2025-0008 AIR record · 2025-02-openai-operator-github-issue-injection
From the supporting source
Operator cannot be fully trusted and these mitigations (which are necessary) will prevent creation of autonomous agents.embracethered.com
The record
Disclosed
2025-02-17
Vendor
OpenAI
Product
OpenAI Operator
Risk domain
Privacy › Sensitive data exposure
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — Operator navigated authenticated sessions and exfiltrated PII
Attack surface
Browser agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection web page
Impact type
Data exfiltration, Pii disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Operator research-preview users
Capability abused
Defense & remediation
Recorded defense
user monitoring, in-context confirmations, out-of-band confirmation when crossing site boundaries
Guardrail kinds
Human approval, Human supervision
Guardrail outcome
Silent
Fix shipped
none specific; OpenAI relies on human-in-the-loop confirmations
Taxonomy & references
Curator notes
Johann Rehberger. Injection hosted in a GitHub issue; Operator navigated to authenticated profile pages on Hacker News and Booking.com, read the user's email/address/phone and typed them into an attacker-controlled site. Key finding: typing text into a page rarely triggers a confirmation dialog, so exfiltration-by-typing evades the approval gate. Also reported as: 'ChatGPT Operator: prompt injection exfiltrates PII from authenticated sites'.
Supporting sources
Cite as
Enkrypt AI. "ChatGPT Operator hijacked by a GitHub issue to exfiltrate PII from authenticated Hacker News and Booking.com sessions". AIR, AIR-2025-0008. https://agentincident.vercel.app/i/AIR-2025-0008/ (accessed 2026-10-19).