Disclosed vulnerability
How deep research agents leak your data across connectors
AIR-2025-0113 AIR record · 2025-08-openai-deep-research-connector-leak
From the supporting source
This highlights the risks with taking the human out of the loop, which appears to be increasingly more common.embracethered.com
The record
Disclosed
2025-08-24
Vendor
OpenAI
Product
ChatGPT Deep Research with connectors
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the deep-research agent carried connector data into third-party tool calls
Attack surface
Enterprise assistant
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection tool description
Impact type
Data exfiltration, Cross tenant data spill
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ChatGPT users with third-party connectors enabled
Capability abused
Defense & remediation
Recorded defense
connector scoping
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
OpenAI now requires custom connectors to implement only search and fetch tools
Taxonomy & references
Curator notes
Data from one connected source can be carried into queries against an untrusted third-party tool.
Supporting sources
Cite as
Enkrypt AI. "How deep research agents leak your data across connectors". AIR, AIR-2025-0113. https://agentincident.vercel.app/i/AIR-2025-0113/ (accessed 2026-10-19).