Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.

Traces / TR-2026-010

agent was the target · researcher disclosure · unreviewed

ShadowLeak: a hidden-text email makes ChatGPT's Deep Research agent exfiltrate Gmail data from OpenAI's own servers

Radware showed that an email carrying instructions hidden in tiny or white-on-white text is read by ChatGPT's Deep Research agent when a user asks it to analyse their Gmail. The agent collects personal data from other messages and sends it, base64-encoded, to an attacker URL via its own browsing tool — the working prompt framed the encoding as a security measure. Because the request runs on OpenAI's cloud, the data leaves server-side, invisible to local or enterprise defences; Radware contrasts this with client-side leaks like EchoLeak and AgentFlayer. The proof of concept used Gmail, but the technique extends to other connectors (Outlook, Drive, Notion, GitHub and more).

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2025-06-18 Radware discloses ShadowLeak to OpenAI · Radware T2
2025-08 OpenAI fixes the issue server-side · The Hacker News T2
2025-09-20 Radware publishes the write-up; The Hacker News reports it · The Hacker News T2

What defenders can take from it

  1. A service-side agent exfiltration leaves no trace on the endpoint — controls that watch the device never see it.
  2. A connector that lets an agent both read mail and browse the web is a read-and-send pair; constrain egress, not just retrieval.

The maintainer's reading of the public reports, not advice specific to your deployment.

Sources · 2

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.