ChatGPT Deep Research Agent Zero-Click Vulnerability Exposed Gmail Data
A zero-click vulnerability in OpenAI's ChatGPT Deep Research agent could have allowed unauthorized access to Gmail accounts linked to the service. Cybersecurity firm Radware discovered the flaw in February 2025 and found no evidence of exploitation. OpenAI patched the vulnerability in September 2025.
What happened
A zero-click vulnerability was discovered in OpenAI's ChatGPT Deep Research agent, a tool designed to help users analyze large amounts of information and access linked Gmail accounts with user permission.
Researchers demonstrated that the flaw could enable attackers to inject hidden instructions via email that would direct the agent to scan Gmail inboxes for personal details such as names and addresses, then forward the data to a web address controlled by attackers.
The vulnerability allowed data theft without the intended target clicking on anything, meaning the data extraction could occur without any user action or awareness.
Reported impact
The vulnerability could have enabled hackers to siphon sensitive data from both corporate and personal Gmail accounts of users who had linked their accounts to the Deep Research service.
Pascal Geenens, Radware's director of threat research, stated that if a corporate account was compromised, the company would not even know that information was leaving.
Index analysis
Radware discovered the vulnerability in February 2025 and found no evidence that attackers had exploited it.
OpenAI confirmed to Radware earlier in September 2025 that it had patched the flaw.
Governance controls
An OpenAI spokesperson stated to Bloomberg that the company prioritizes the safety of its models and is continuously working to strengthen its technology against such exploits.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.