Research demo
ChatGPT + custom MCP: a malicious calendar invite makes the agent email the victim's inbox to the attacker, disguising the approval prompt
AIR-2025-0133 AIR record · 2025-09-openai-chatgpt-custom-mcp-calendar-exfil
From the supporting source
Because the attacker in the calendar invite asked the LLM to only ask the user 'Would you like me to help you prepare for it' for the approval step instead of actually describing what it does — the LLM follows that instruction and the user really doesn't know what they are approving.promptarmor.substack.com
The record
Disclosed
2025-09-13
Vendor
OpenAI
Product
ChatGPT with custom MCP connectors (Zapier Gmail)
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent read the invite and emailed the inbox to the attacker
Attack surface
MCP server
Autonomy level
Copilot with approval
Initial vector
Indirect prompt injection calendar invite
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ChatGPT users with write-enabled custom MCP connectors
Capability abused
Defense & remediation
Recorded defense
human approval step before tool execution
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
unfixed; mitigations recommended but not default
Taxonomy & references
Curator notes
PromptArmor, demonstrated 2025-09-12. The interesting primitive is approval-prompt content being attacker-controlled: the human is in the loop but is shown a benign description of a malicious action. Related to but distinct from 2025-08-google-gemini-calendar-promptware and 2026-01-google-gemini-calendar-invite-leak.
Supporting sources
Cite as
Enkrypt AI. "ChatGPT + custom MCP: a malicious calendar invite makes the agent email the victim's inbox to the attacker, disguising the approval prompt". AIR, AIR-2025-0133. https://agentincident.vercel.app/i/AIR-2025-0133/ (accessed 2026-10-19).