ShadowLeak — ChatGPT Deep Research zero-click data exfiltration from connected services
Date: 2025-09
Affected: ChatGPT Deep Research — Gmail, Dropbox, GitHub, SharePoint connected services
Attack vector: prompt-injection
Category: research-demonstrated
Severity: Critical

Zero-click, service-side vulnerability in ChatGPT Deep Research. Hidden prompt injection in email HTML causes the agent to exfiltrate sensitive data from connected services (Gmail, Dropbox, GitHub, SharePoint) directly from OpenAI's cloud infrastructure — invisible to local/enterprise defenses.

Impact: Zero-click enterprise data exfiltration; invisible to all local security tools; multi-service compromise

Mitigations:
Connected service permission scoping
Data access auditing for AI agent queries
Server-side content sanitization for AI-processed content

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: Deep Research agent processes email with hidden injection
role: origin
label: Agent Ecosystem
notes: Exfiltration happens server-side, invisible to local defenses
role: propagation
label: Data Operations
notes: Data from Gmail, Dropbox, GitHub, SharePoint exfiltrated
role: impact