Cybersecurity researchers have uncovered a dangerous zero-click vulnerability in OpenAI’s ChatGPT Deep Research agent that could expose sensitive Gmail data through a single malicious email—without requiring any user interaction.
## The ShadowLeak Attack
Security firm Radware discovered and named this new attack method “ShadowLeak.” The vulnerability was responsibly disclosed to OpenAI on June 18, 2025, and was patched in early August.
The attack works through an indirect prompt injection hidden within email HTML code. Attackers can conceal malicious commands using techniques like:
– Microscopic font sizes
– White text on white backgrounds
– CSS layout manipulation
These hidden instructions remain invisible to users but are still processed by the AI agent.
## How the Attack Works
When a victim asks ChatGPT’s Deep Research to analyze their Gmail emails, the AI unknowingly follows the hidden commands embedded in the malicious email. The agent then:
1. Scans other emails in the inbox for personal information
2. Extracts sensitive data
3. Encodes it in Base64 format
4. Transmits it to the attacker’s server using the browser.open() function
“We framed this action as a necessary security measure to protect the data during transmission,” Radware researchers explained, describing how they tricked the AI into believing the data theft was legitimate.
## Broader Security Implications
This vulnerability extends beyond Gmail. The attack method could potentially work with any service ChatGPT integrates with, including:
– Box and Dropbox
– GitHub and Google Drive
– Microsoft Outlook
– Notion and SharePoint
– HubSpot
What makes ShadowLeak particularly dangerous is that it operates entirely within OpenAI’s cloud infrastructure, making it invisible to traditional security defenses that monitor local networks.
## Additional AI Security Concerns
Separately, AI security platform SPLX demonstrated another concerning vulnerability where ChatGPT can be manipulated to solve CAPTCHAs—security tests designed to verify human users. By reframing CAPTCHAs as “fake” challenges and using context manipulation, researchers successfully bypassed these security measures.
## The Growing Challenge
These discoveries highlight the expanding attack surface as AI agents become more integrated with personal and business applications. Unlike previous client-side attacks, ShadowLeak operates invisibly in the cloud, emphasizing the need for enhanced AI security measures and continuous monitoring of these powerful but potentially vulnerable systems.
The incidents underscore the critical importance of robust security testing as AI capabilities continue to evolve and integrate deeper into our digital workflows.