ZombieAgent Vulnerability Enables Data Theft and Account Takeover in ChatGPT
Radware researchers disclosed ZombieAgent, a zero-click prompt injection vulnerability in OpenAI's Deep Research agent that allows attackers to embed malicious instructions to steal sensitive data and establish persistence. The vulnerability can propagate across contacts like a worm, and OpenAI reportedly patched it on December 16, 2025.
What happened
Radware researchers disclosed ZombieAgent, a zero-click indirect prompt injection vulnerability affecting OpenAI's Deep Research agent. The vulnerability allows attackers to direct the agent to autonomously exfiltrate sensitive customer data from OpenAI servers through malicious instructions embedded in untrusted inputs.
The attack can implant malicious rules into the agent's long-term memory, enabling the attacker to establish persistence and execute hidden actions every time the agent is used. The vulnerability is capable of propagating across additional contacts or email recipients, potentially becoming a worm-like campaign inside organizations.
Reported impact
The vulnerability could expose enterprises to invisible data theft, persistent agent hijacking, and service-side execution that could bypass an organization's security controls. A single malicious email could become the entry point to a growing, automated attack campaign.
Index analysis
The vulnerability illustrates what researchers described as a critical structural weakness in agentic AI platforms that enterprises rely on to make decisions and access sensitive systems while lacking visibility into how agents interpret untrusted information.
Governance controls
OpenAI patched the vulnerability on December 16, 2025.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.