ChatGPT vulnerability exposed as ZombieAgent attack bypasses OpenAI security guardrails

ChatGPT Vulnerability Resurfaces with ZombieAgent Attack

Security researchers at Radware have uncovered a new ChatGPT vulnerability that exposes a fundamental flaw in how AI chatbots handle security threats. The ZombieAgent attack successfully bypasses security measures OpenAI implemented just months ago, demonstrating what experts describe as a vicious cycle in AI development where patches address specific exploits rather than underlying vulnerabilities 1

1

. The attack allows malicious actors to exfiltrate sensitive user data directly from ChatGPT servers, leaving no trace on user machines—a capability that poses serious risks for enterprises relying on agentic AI platforms 2

2

.

How the Data Pilfering Attack Evolved from ShadowLeak

The story begins with ShadowLeak, a data exfiltration vulnerability that Radware disclosed in September 2025. This indirect prompt injection attack targeted Deep Research, a ChatGPT-integrated AI agent, by embedding malicious instructions into emails or documents that users asked the LLM to summarize 1

1

. The original exploit instructed Deep Research to construct URLs with appended parameters containing sensitive information like employee names and addresses, sending this data to attacker-controlled servers through event logs 1

1

.

OpenAI responded on September 3, 2025, by implementing guardrails that restricted ChatGPT from modifying URLs or adding URL parameters, even when explicitly instructed 2

2

. The fix appeared effective until Radware discovered a bypass method that revived the threat.

The Bypass Method Behind ZombieAgent's Success

The ZombieAgent attack demonstrates how easily attackers can circumvent reactive security measures. Instead of constructing dynamic URLs, the revised prompt injection supplies a complete list of pre-constructed URLs, each appended with a single character—example.com/a, example.com/b, through the entire alphabet, plus example.com/0 through example.com/9 1

1

. This character-by-character exfiltration technique and indirect link manipulation allowed the attack to extract data letter by letter, technically complying with OpenAI's restrictions while achieving malicious goals 1

1

.

Zvika Babo, Radware threat researcher, noted that "ChatGPT can now only open URLs exactly as provided and refuses to add parameters, even if explicitly instructed. We found a method to fully bypass this protection" 2

2

.

Attack Persistence Through Memory Feature Exploitation

What makes ZombieAgent particularly dangerous is its ability to achieve attack persistence by exploiting ChatGPT's memory feature. The bypass logic gets stored in the long-term memory assigned to each user, allowing the exploit to remain active across sessions 1

1

. The attack plants instructions that tell ChatGPT to read specific emails and execute embedded commands whenever users send messages, while simultaneously saving sensitive information to memory 2

2

.

OpenAI attempted to prevent this by blocking connectors and memory from being used simultaneously, but researchers found ChatGPT can still access and modify memory before using connectors in subsequent actions 2

2

. Radware's security team even demonstrated potential for damage beyond data exfiltration—by modifying stored medical history to cause the model to emit incorrect medical advice 2

2

.

The Critical Structural Weakness in AI Chatbots

The root cause of this vulnerability class lies in the fundamental design of AI chatbots. LLM systems cannot reliably distinguish between valid instructions from users and those embedded in external content like emails or documents 1

1

. This creates what Pascal Geenens, VP of threat intelligence at Radware, describes as a critical structural weakness: "Enterprises rely on these agents to make decisions and access sensitive systems, but they lack visibility into how agents interpret untrusted content or what actions they execute in the cloud. This creates a dangerous blind spot that attackers are already exploiting" 2

2

.

Because AI is inherently designed to comply with user requests, guardrails remain reactive and ad hoc—built to foreclose specific attack techniques rather than addressing the broader vulnerability class 1

1

. Radware researchers explain that "attackers can easily design prompts that technically comply with these rules while still achieving malicious goals" because "the LLM has no inherent understanding of intent and no reliable boundary between system instructions and external content" 1

1

.

OpenAI's Latest Response and What Comes Next

OpenAI addressed the ZombieAgent attack on December 16, 2025, by restricting ChatGPT from opening links originating from emails unless they appear in a well-known public index or were provided directly by users in chat prompts 1

1

. This mitigation aims to bar agents from opening base URLs leading to attacker-controlled domains. However, the pattern suggests this may not be the final chapter. The vulnerability was initially filed as a bug report on September 26, 2025, and took nearly three months to patch 2

2

.

The implications extend beyond ChatGPT. This type of prompt injection attack has been demonstrated repeatedly against virtually all major large language models, affecting systems linked to ChatGPT including Gmail, Outlook, Google Drive, and GitHub 2

2

. For enterprises deploying AI agents with access to sensitive systems, the inability of developers to reliably close this vulnerability class represents an ongoing security challenge that demands vigilance and layered defense strategies.