Hijacked by injectionPI-0027
ShadowLeak: hidden email text made ChatGPT's Deep Research agent send inbox data from OpenAI's servers
Radware showed that when a user asked ChatGPT's Deep Research agent, connected to Gmail, to research their inbox, an email with concealed instructions could make it gather personal data and send it to an attacker's web address. Because the request came from OpenAI's own infrastructure, local and enterprise defenses would not see it. Radware reported the issue in June 2025 and OpenAI fixed it in early August.
- Harm
- Harm: No harm reportedAdds nothing to the index.
- Control
- Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Near miss. Harm was plausible but prevented. It is rated only on what actually happened.
Sources
How we know
3 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- researchShadowLeak: A Zero-Click, Service-Side Attack Exfiltrating Sensitive Data Using ChatGPT's Deep Research AgentRadware · Sept. 18, 2025radware.com/blog/threat-intelligence/shadowleak/
- newsShadowLeak zero-click flaw leaks GmailThe Hacker News · Sept. 20, 2025thehackernews.com/2025/09/shadowleak-zero-click-flaw-leaks-gmail.html
- newsOpenAI fixes zero-click ShadowLeak vulnerabilityThe Record · Sept. 18, 2025therecord.media/openai-fixes-zero-click-shadowleak-vulnerability
Why this rating
No harm reported; control failure level 2
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm reportedResearcher demonstration on controlled accounts; no victims reported.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Instruction violationThe agent followed injected instructions using its Gmail connector and browsing tool, within its permissions.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
No external harm was reported from this controlled test. Control level 2 reflects injected instructions obeyed within permissions. This is a near miss.
Effect on the index
It does not count toward the Sept. 22 reading
The reading for the week to Sept. 22, 2025, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 4 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | — (none counting) | — (none counting) |
| Harms at that level, nposition in the band | 0 | 0 |
| Highest control level breachedsets the reading only when no harm counts | 3 | 3 |
| Readingrounded down | 3 Control failures only | 3 Control failures only |
Inside the window of 4 weekly readings
| Week to | Reading | Band |
|---|---|---|
| Sept. 22, 2025 | 3 | Control failures only |
| Sept. 29, 2025 | 3 | Control failures only |
| Oct. 6, 2025 | 3 | Control failures only |
| Oct. 13, 2025 | 3 | Control failures only |
Revisions
What we changed
5 logged. Every change to a rating is logged here, with the reason.
- v5Oct. 6, 2026
Ratings confirmed by the editor.
- v4Oct. 3, 2026
Audit corrections: verification Multiple credible sources → Developer confirmed (The Record, 18 Sep 2025: OpenAI confirmed the report came through its bug bounty); no eligibility effect, impact not reported. Discovery dated 18 Jun 2025, when it was reported to OpenAI; status note gives the early-August fix and 3 Sep resolution and Radware's finding of no exploitation in the wild. Summary clarifies that the user had to ask the agent to research the inbox. Sources dated; Radware's blog was behind a bot check, its 18 Sep date is from the press release and coverage. Ratings unchanged.
- v3Oct. 2, 2026
Report date resolved from month precision (2025-09, placed on the 1st) to 2025-09-18: Radware's public disclosure on 18 Sep 2025 (press release; The Register and others on 19 Sep).
- v2Sept. 30, 2026
Rated: impact not reported; control type instruction violation.
- v1Sept. 30, 2026
Backfilled from public reporting.
Cite and share
Use this record
Citation
Paperclip Index. “ShadowLeak: hidden email text made ChatGPT's Deep Research agent send inbox data from OpenAI's servers.” Record PI-0027. Reported Sept. 18, 2025; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0027