SpAIware: Persistent Memory Spyware Injection into ChatGPT macOS
Date: 2024-09
Affected: OpenAI ChatGPT macOS app
Attack vector: memory-poisoning
Category: research
Severity: Critical

Johann Rehberger demonstrated injecting persistent malicious instructions into ChatGPT's long-term memory via indirect prompt injection, causing continuous exfiltration of all future conversations. Fixed by OpenAI September 2024.


Mitigations:

Architectural layers (MAESTRO):