HackedGPT: New Vulnerabilities in GPT Models Allow Attackers to Launch 0-Click Attacks

Cybersecurity researchers at Tenable have uncovered a series of critical vulnerabilities in OpenAI’s ChatGPT that could allow malicious actors to steal private user data and launch attacks without any user interaction.The security flaws affect hundreds of millions of users who interact with large language models daily, raising significant concerns about the safety of AI.Seven Critical Vulnerabilities Discovered in Latest GPT ModelsThe research team identified seven distinct vulnerabilities and attack techniques that exploit weaknesses in ChatGPT’s processing of external data.These vulnerabilities are present in the latest GPT-5 model and affect ChatGPT 4 as well.The most alarming discovery is a zero-click attack vector that can compromise users simply by asking ChatGPT an innocent question that triggers a web search.The vulnerabilities exploit ChatGPT’s memory feature, which is enabled by default and stores potentially sensitive user information across conversations.Tenable researchers discovered methods to inject malicious prompts through various channels, including comment sections on trusted websites, indexed web pages, and direct URL parameters.One particularly sophisticated technique called “Conversation Injection” allows attackers to manipulate ChatGPT by inserting instructions into SearchGPT’s responses, effectively prompting ChatGPT to inject itself.When searching using Bing, if we hover over the results, we can see that they redirect to bing.com/ck/a links. Perhaps most concerning is the safety mechanism bypass vulnerability that leverages Bing tracking links to circumvent OpenAI’s url_safe endpoint. This security feature was designed to prevent malicious URLs from reaching users.Still, researchers found that Bing.com’s allowed status allows attackers to exfiltrate user data one character at a time using static tracking links that redirect to attacker-controlled domains.Beyond immediate threats, Tenable researchers demonstrated that attackers can achieve persistence by manipulating ChatGPT’s memory system.We inject a prompt to SearchGPT, which in turn injects a prompt to ChatGPT within its response. Through the Memory Injection technique, malicious actors can update a user’s memories to include instructions for data exfiltration that will execute with every subsequent ChatGPT response.This creates a persistent threat that continues leaking private information across different conversations, sessions, and even days after the initial compromise.The research team also discovered a markdown rendering bug that allows attackers to hide malicious content from users while ChatGPT still processes the hidden instructions.This technique makes attacks virtually undetectable to victims who trust ChatGPT’s responses and are unaware that their data is being exfiltrated.Tenable provided multiple proof-of-concept demonstrations showing how these vulnerabilities can be chained together for a devastating effect.In one scenario, attackers spray malicious prompts in comment sections on popular blogs and news sites.When users ask ChatGPT to summarize these articles, they unknowingly trigger the prompt injection, leading to phishing attacks or data theft.The most severe attack vector requires zero user interaction beyond asking a question. Attackers create websites about specific topics, inject prompts that only appear when SearchGPT browses them, and wait for the sites to be indexed by OpenAI’s crawler.When users search for information related to these topics, ChatGPT automatically sources the malicious websites and becomes compromised.This unprecedented vulnerability could enable targeted attacks based on current events, political trends, or niche interests, affecting anyone who relies on AI-powered search functionality.Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Based on reporting by GBHackers.