Disclosed vulnerability
ShadowLeak: server-side zero-click Gmail exfiltration via ChatGPT Deep Research agent
AIR-2025-0134 AIR record · 2025-09-openai-shadowleak
From the supporting source
The experts discovered a zero-click vulnerability in ChatGPT’s Deep Research agent when connected to Gmail and browsing.securityaffairs.com
The record
Disclosed
2025-09-18
Vendor
OpenAI
Product
ChatGPT Deep Research (Gmail connector)
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the Deep Research agent browsed server-side and exfiltrated Gmail
Attack surface
Enterprise assistant
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection email
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ChatGPT users/tenants with Gmail (or other) connectors enabled to Deep Research
Capability abused
Defense & remediation
Recorded defense
agent guardrails on tool use; no egress control on the agent's own server-side fetches
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
OpenAI fixed in early August 2025; marked resolved 2025-09-03
Taxonomy & references
Curator notes
Radware researchers Zvika Babo, Gabi Nakibly and Maor Uziel; disclosed to OpenAI via Bugcrowd on 2025-06-18. Radware's own blog (radware.com/blog/threat-intelligence/shadowleak/) is behind a bot-check page, so secondary coverage (Security Affairs) is used as the primary source per the curation rule. Distinguishing feature: exfiltration happens from OpenAI's cloud, leaving no network evidence in the customer's environment. Radware says the technique extends to other connectors (Box, Dropbox, GitHub, Drive, HubSpot, Outlook, Notion, SharePoint).
Supporting sources
Cite as
Enkrypt AI. "ShadowLeak: server-side zero-click Gmail exfiltration via ChatGPT Deep Research agent". AIR, AIR-2025-0134. https://agentincident.vercel.app/i/AIR-2025-0134/ (accessed 2026-10-19).