#shadowleak

[ follow ]
#prompt-injection #llm-security #data-exfiltration #mitigation #chatgpt-deep-research
fromArs Technica
5 hours ago

New attack on ChatGPT research agent pilfers secrets from Gmail inboxes

Accordingly, OpenAI mitigated the prompt-injection technique ShadowLeak fell to-but only after Radware privately alerted the LLM maker to it. A proof-of-concept attack that Radware published embedded a prompt injection into an email sent to a Gmail account that Deep Research had been given access to. The injection included instructions to scan received emails related to a company's human resources department for the names and addresses of employees. Deep Research dutifully followed those instructions.
Information security
Information security
fromSecurityWeek
7 hours ago

ChatGPT Deep Research Targeted in Server-Side Data Theft Attack

ShadowLeak is a server-side data exfiltration method targeting ChatGPT's Deep Research, enabling silent extraction of inbox data via attacker-controlled URLs without user interaction.
[ Load more ]