GPT-4.1 jailbreak via tool poisoning
Date: 2025-04-29
Affected: OpenAI GPT-4.1 (tool/agent integrations)
Attack vector: tool-abuse
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-23254
CWE: CWE-502
CVSS:  (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Attackers exploited GPT-4.1's tool integration by embedding malicious instructions within tool descriptions. This 'tool poisoning' caused the AI to execute unauthorized actions including data exfiltration without user awareness.

Impact: User privacy violation at scale; API key exposure enabling unauthorized access; demonstrates that frontier AI labs have basic infrastructure security gaps; regulatory exposure under Chinese data protection law and GDPR for EU users

Mitigations:
Authentication required on all databases — no exceptions for internal/staging
Automated infrastructure scanning for open ports and unauthenticated services
Data classification: chat logs classified as PII, stored with encryption at rest
Network segmentation: databases never exposed to public internet

Architectural layers (MAESTRO):