ChatGPT Connectors vulnerability enables zero-click data theft via poisoned documents
Researchers discovered a vulnerability in OpenAI's ChatGPT Connectors feature that could allow attackers to extract sensitive data from users' Google Drive accounts through poisoned documents containing hidden prompts. The zero-click attack required no user action and could exfiltrate information like API keys. OpenAI mitigated the issue after the researchers reported their findings.
What happened
Security researchers Michael Bargury and Tamir Ishay Sharbat revealed an exploit at the Black Hat hacker conference in Las Vegas that could allow attackers to extract sensitive data from users' Google Drive accounts through ChatGPT's Connectors tool.
The attack, dubbed AgentFlayer, works by sharing a poisoned document to a victim's Google Drive that contains a hidden malicious prompt. When ChatGPT reads the file, the hidden prompt—which could be disguised in white text at size one font—instructs the AI to search for and exfiltrate specific information, such as API keys stored in other Drive files.
The exploit required no user interaction beyond having Connectors enabled and connected to Google Drive. Bargury reported the vulnerability to OpenAI earlier in 2025, and the company introduced mitigations after reviewing the findings.
Reported impact
Victims could lose access to sensitive data stored in Google Drive, including API keys and other confidential information, without any awareness that the attack was occurring.
The vulnerability demonstrated that any service connected to ChatGPT could potentially be targeted for data exfiltration, not just Google Drive.
Index analysis
The attack illustrates a broader risk of indirect prompt injection attacks against AI systems integrated with external data sources and services.
Connecting AI models to external systems increases the attack surface and multiplies the ways vulnerabilities can be introduced, according to the researchers.
Governance controls
OpenAI mitigated the vulnerability after the researchers disclosed it and introduced preventative measures to block the technique used in the attack.
Google Workspace senior director Andy Wen noted the importance of developing robust protections against prompt injection attacks and referenced the company's enhanced AI security measures.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.