AgentFlayer: poisoned document makes ChatGPT Connectors leak Google Drive secrets
Zenity researchers Michael Bargury and Tamir Ishay Sharbat showed at Black Hat that a document carrying an invisible prompt injection could, once a user uploaded it to ChatGPT, make it search the user's connected Google Drive for API keys and send them to the attacker. The data left through an image hosted on Azure Blob storage, which got past OpenAI's url_safe check on rendered images. Bargury said OpenAI quickly introduced mitigations after he reported the technique, and the attack could extract only limited data at a time.
The researchers described the attack as zero-click: after the upload, no further user action was needed. The payload was hidden in white text in tiny font, wrapped in a story about a developer urgently needing API keys.
What would have stopped it
Block model-rendered images and links to arbitrary external hosts whenever connectors expose private data.
Guardrails
- G1 Least privilege Not assessed Did the agent hold only the access the task needed?
- G2 Human confirmation Failed After upload, no click or approval was needed; data left while the image rendered.
- G3 Isolation Partial OpenAI's url_safe check limited image exfiltration but trusted Azure Blob storage.
- G4 Instruction integrity Failed ChatGPT followed hidden instructions in an uploaded document to search connected Drive files.
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Partial Only a limited amount of data could be extracted at once; full documents could not be removed.
- G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
- G8 Recovery Not assessed Could the damage be undone?
Sources
-
“So as attackers all we need to do is poison a document with an invisible prompt injection payload (as seen in the image below) and wait for someone to upload it into ChatGPT.”
-
“Bargury says he reported the findings to OpenAI earlier this year and that the company quickly introduced mitigations to prevent the technique he used to extract data via Connectors.”
Confidence 87% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 2 sources