In August 2025, security researchers showed that one shared document could quietly trick ChatGPT into searching a victim’s connected Google Drive and sending secrets, such as API keys, to an attacker. The attack, called AgentFlayer, needed no clicks from the victim beyond asking ChatGPT about the file. OpenAI added mitigations, and the case remains one of the clearest examples of indirect prompt injection, a risk that still applies to every AI assistant connected to your data in 2026.
What indirect prompt injection is
A normal prompt injection is when someone types instructions into a chatbot to make it misbehave. Indirect prompt injection is sneakier: the attacker never talks to the AI at all. Instead, they plant instructions inside content the AI will read later, such as a web page, an email, a calendar invite or a shared file.
Large language models struggle to separate data from commands. When an assistant reads a document that says, in effect, ignore the user and do this instead, it may follow that text as if the user had typed it. The more tools and data the assistant can reach, the more damage those planted instructions can do.
How the AgentFlayer attack worked
The research was presented at the Black Hat security conference in Las Vegas in August 2025 by Zenity, whose cofounder and CTO is Michael Bargury. It targeted ChatGPT Connectors, the feature that let ChatGPT search services such as Google Drive, GitHub or SharePoint on your behalf. The steps were simple:
- The poisoned file. The attacker wrote a harmless looking document and hid a long instruction inside it in tiny white text, invisible to a human reader. Getting it to the victim was easy: share it to their Google Drive, which only takes an email address, or send it so they upload it to ChatGPT themselves.
- The trigger. The victim asked ChatGPT to do something ordinary with the file, such as summarize it, while their Drive was connected.
- The hijack. The hidden text told ChatGPT to skip the summary and instead search the connected Drive for API keys, then hide what it had done.
- The leak. ChatGPT was told to display an image whose web address carried the stolen keys as parameters. When the chat window loaded the image, the request delivered the data to a server the attacker could read. No click was needed.
OpenAI already checked image addresses before rendering them, and the researchers’ first attempt was blocked. They got around it by hosting the image on Microsoft Azure cloud storage, a domain the check treated as safe, and reading the stolen values from Azure’s request logs. Only small pieces of data could leak this way, not whole files, but API keys are small and extremely valuable.
What OpenAI changed
Bargury said he reported the issue to OpenAI earlier in 2025 and that the company quickly added mitigations against the specific technique. Since then, the product has changed in several ways that matter for this kind of attack:
- Connectors became apps. OpenAI now calls these integrations connected apps in ChatGPT. Apps can only reach what you authorized when connecting them, and workspace admins can disable them.
- Action approvals. ChatGPT can ask before reading information or taking an action, with settings ranging from Always ask to Allow all actions. The default allows low risk actions, and sensitive actions may still require approval.
- Lockdown Mode. Announced February 13, 2026, it limits features that reach outside OpenAI’s network, including live web browsing, live connectors, Deep Research, Agent Mode and images in responses. It started on Enterprise, Edu, Healthcare and Teachers plans, and a June 2026 update extended it to personal accounts and self serve Business accounts.
- Elevated Risk labels. Features that carry extra risk now show a standard label explaining what could go wrong.
How to reduce your risk in 2026
| Who | What to do |
|---|---|
| Individual users | Connect only apps you actually use, and disconnect the rest in ChatGPT settings. |
| Individual users | Keep approvals on Always ask or the default, never Allow all actions, on accounts linked to work or money. |
| Individual users | Be cautious with files and links shared by people you do not know, and open them without AI help first. |
| Businesses | Restrict which apps are enabled per role, and use Lockdown Mode roles for staff handling sensitive data. |
| Businesses | Never store passwords or API keys in shared drives or documents. Use a secrets manager and rotate keys. |
| Businesses | Review compliance logs for app activity and limit external sharing into company drives. |
FAQ
Is the AgentFlayer attack still possible in ChatGPT?
The specific technique shown in 2025 was mitigated, according to the researchers. Indirect prompt injection as a category has not been solved by any AI company, so new variants keep appearing.
Did I need to click anything to be affected?
No. In the demonstration, the victim only had to ask ChatGPT about the poisoned file. The data left through an image that loaded automatically.
Should I stop using ChatGPT apps?
Not necessarily. Apps are useful, but treat each one as a door into your data. Connect the minimum, keep approvals on and use Lockdown Mode if your account holds sensitive information.
Are other AI assistants safer?
Not by default. The same research found related issues in Microsoft, Google and Salesforce products. Any assistant that reads outside content and has access to your files carries this risk.
The verdict
AgentFlayer showed that the weak point of a connected AI assistant is the content it reads, not the chat box. OpenAI patched the specific trick and has since added approvals and Lockdown Mode, but the safest setup is still the simplest: fewer connected apps, approvals switched on, and no secrets sitting in shared documents.
Updated October 2026: explains the AgentFlayer research, indirect prompt injection, OpenAI’s later safeguards and practical steps for users and businesses.
Featured photo: Markus Winkler on Unsplash.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
