OpenAI CEO warns ChatGPT Agent users of data disclosure risks
OpenAI CEO Sam Altman warned users that the newly deployed ChatGPT Agent, capable of autonomous task execution, could be manipulated by malicious actors to disclose sensitive data through prompt injection and jailbreak attacks. Altman advised against using the system for critical applications or with sensitive information and recommended limiting its access permissions.
What happened
OpenAI CEO Sam Altman warned users on X (Twitter) about risks posed by the newly deployed ChatGPT Agent, which became available to Pro, Plus and Team subscribers from 17 July 2025.
The ChatGPT Agent is capable of autonomously executing complex, multi-step tasks by navigating websites, filtering results, and interacting with web portals. Altman described it as 'state-of-the-art and experimental' and cautioned against using it for critical applications or with sensitive data.
Reported impact
Altman warned that malicious actors could trick the agent into disclosing private data, and specifically cautioned that if users grant the agent access to their email, bad actors could use malicious emails to instruct the agent to reveal sensitive information.
Index analysis
Altman emphasized that jailbreaks and prompt injections pose particular risks for autonomous AI systems. He recommended granting the agent only the minimum access rights necessary to complete a task, such as calendar access but not permission to purchase clothing directly.
OpenAI stated it has implemented security measures, though their effectiveness remains unclear.
Governance controls
OpenAI is deploying the ChatGPT Agent with a gradual rollout strategy using minimal access rights. Users are advised to exercise caution when granting permissions, particularly for email access, and to restrict the system from handling sensitive or critical data.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.