Disclosed vulnerability
AgentFlayer: 0-click exfiltration of Google Drive secrets via poisoned document through ChatGPT Connectors
AIR-2025-0084 AIR record · 2025-08-openai-agentflayer-chatgpt-connectors
From the supporting source
As attackers all we need to do is poison a document with an invisible prompt injection payload and wait for someone to upload it into ChatGPT.labs.zenity.io
The record
Disclosed
2025-08-06
Vendor
OpenAI
Product
ChatGPT Connectors (Google Drive)
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Confused deputy
System type
Generative model
Who acted
Agent acted — ChatGPT searched Drive and rendered the exfiltration image
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ChatGPT users with Connectors enabled to Google Drive and similar stores
Capability abused
Defense & remediation
Recorded defense
OpenAI url_safe client-side URL check before rendering images
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
OpenAI had mitigations in place; researchers bypassed url_safe using Azure Blob Storage URLs
Taxonomy & references
Curator notes
Author: Tamir Ishay Sharbat, Zenity Labs, published 2025-08-06 and presented at Black Hat USA 2025 as part of AgentFlayer. Zenity's research hub states: 'Attack simulation allowed for the hijacking of ChatGPT sessions using just an email address. Once compromised, they gain access to Google Drive, manipulate memory, and exfiltrate sensitive data - all without user input.' No CVE assigned. Also reported as: 'AgentFlayer: zero-click exfiltration of Google Drive secrets via ChatGPT Connectors'.
Supporting sources
Cite as
Enkrypt AI. "AgentFlayer: 0-click exfiltration of Google Drive secrets via poisoned document through ChatGPT Connectors". AIR, AIR-2025-0084. https://agentincident.vercel.app/i/AIR-2025-0084/ (accessed 2026-10-19).