{
 "id": "TR-2026-010",
 "status": "published",
 "title": "ShadowLeak: a hidden-text email makes ChatGPT's Deep Research agent exfiltrate Gmail data from OpenAI's own servers",
 "date": "2025-09-20",
 "window": "Disclosed to OpenAI 18 Jun 2025; fixed early Aug 2025; published 20 Sep 2025",
 "ai_role": "target",
 "category": "red_team",
 "summary": "Radware showed that an email carrying instructions hidden in tiny or white-on-white text is read by ChatGPT's Deep Research agent when a user asks it to analyse their Gmail. The agent collects personal data from other messages and sends it, base64-encoded, to an attacker URL via its own browsing tool — the working prompt framed the encoding as a security measure. Because the request runs on OpenAI's cloud, the data leaves server-side, invisible to local or enterprise defences; Radware contrasts this with client-side leaks like EchoLeak and AgentFlayer. The proof of concept used Gmail, but the technique extends to other connectors (Outlook, Drive, Notion, GitHub and more).",
 "attacker": {
  "description": "Security researchers (Radware: Zvika Babo, Gabi Nakibly, Maor Uziel), proof of concept"
 },
 "defender": {
  "description": "OpenAI — fixed the issue roughly seven weeks after disclosure"
 },
 "scale": "Any data reachable through the victim's connected Gmail; service-side",
 "impact": "Zero-click exfiltration of mailbox data with no local footprint",
 "tactics": [
  "TA0001",
  "TA0005",
  "TA0009",
  "TA0010"
 ],
 "timeline": [
  {
   "date": "2025-06-18",
   "text": "Radware discloses ShadowLeak to OpenAI",
   "tier": 2,
   "source": "2"
  },
  {
   "date": "2025-08",
   "text": "OpenAI fixes the issue server-side",
   "tier": 2,
   "source": "1"
  },
  {
   "date": "2025-09-20",
   "text": "Radware publishes the write-up; The Hacker News reports it",
   "tier": 2,
   "source": "1"
  }
 ],
 "lessons": [
  "A service-side agent exfiltration leaves no trace on the endpoint — controls that watch the device never see it.",
  "A connector that lets an agent both read mail and browse the web is a read-and-send pair; constrain egress, not just retrieval."
 ],
 "models_named": [],
 "related_agents": [],
 "vendor_response": "Fixed server-side by OpenAI (early August 2025)",
 "sources": [
  {
   "title": "ShadowLeak zero-click flaw leaks Gmail data via ChatGPT Deep Research",
   "url": "https://thehackernews.com/2025/09/shadowleak-zero-click-flaw-leaks-gmail.html",
   "outlet": "The Hacker News",
   "date": "2025-09-20"
  },
  {
   "title": "ShadowLeak: A Zero-Click, Service-Side Attack Exfiltrating Sensitive Data Using ChatGPT's Deep Research Agent",
   "url": "https://www.radware.com/blog/threat-intelligence/shadowleak/",
   "outlet": "Radware",
   "date": "2025-09-20"
  }
 ],
 "reviewer": null,
 "checked_on": null
}