Disclosed vulnerability
Exfiltrating ChatGPT chat history and memories via a url_safe allowlist bypass
AIR-2025-0073 AIR record · 2025-08-openai-chatgpt-history-memory-exfil
From the supporting source
If you process untrusted content, like summarizing a website, or analyze a pdf document, the author of that document can exfiltrate any information present in the prompt context.embracethered.com
The record
Disclosed
2025-08-01
Vendor
OpenAI
Product
ChatGPT
Risk domain
Privacy › Data exfiltration channels
Also touches
Sensitive data exposure, Confused deputy
System type
Generative model
Who acted
Agent acted — the assistant fetched the allowlist-bypassing URL with the history
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration, Privacy violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ChatGPT users processing untrusted PDFs or websites
Capability abused
Defense & remediation
Recorded defense
OpenAI url_safe domain allowlist and URL safety check
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
addressed by OpenAI as of 2025-08-26 (per the post's update); the specific bypass was reported October 2024
Taxonomy & references
Curator notes
Month of AI Bugs. Abuses Azure Blob Storage logging as the collection endpoint. | Merged from duplicate id `2025-08-openai-chatgpt-history-exfil`. Also reported as: 'Exfiltrating ChatGPT chat history and memories with prompt injection'.
Supporting sources
Cite as
Enkrypt AI. "Exfiltrating ChatGPT chat history and memories via a url_safe allowlist bypass". AIR, AIR-2025-0073. https://agentincident.vercel.app/i/AIR-2025-0073/ (accessed 2026-10-19).