Security researchers from Radware have revealed how recent ChatGPT features — connectors and long-term memory — can significantly amplify the impact of indirect prompt injection (IPI) attacks.
Their proof-of-concept, dubbed ZombieAgent, demonstrates that ChatGPT remains vulnerable to IPI and that new capabilities can make such attacks more persistent, stealthy, and scalable than ever before.
What’s new — and why it matters
ChatGPT now supports:
- Connectors (integration with email, productivity tools, etc.)
- Long-term memory - allowing the AI to retain information across sessions
Radware demonstrated that these features can be weaponized.
An attacker can:
- Send a victim a malicious email containing hidden instructions (white text, tiny font, invisible content)
- Trick the victim into asking ChatGPT to process that email (e.g., “summarize my unread messages”)
- Have the AI unknowingly ingest and execute the attacker’s instructions
Because ChatGPT does not reliably distinguish user intent from injected content, the malicious prompt is processed as trusted input.
ZombieAgent’s key innovation: persistence
What makes ZombieAgent particularly dangerous is the abuse of ChatGPT’s memory feature.
Radware showed that:
- Malicious instructions can be stored in the agent’s memory
- Once implanted, the AI re-executes those instructions automatically
- The user doesn’t need to trigger the attack again
In other words, the AI becomes a persistent compromised agent — a “zombie” — capable of:
- Recording sensitive information
- Exfiltrating data
- Potentially spreading itself via connected services (worm-like behavior)
Data exfiltration without obvious URLs
Although OpenAI previously blocked dynamic URL manipulation, attackers bypassed this by:
- Providing a predefined glossary of URLs mapped to characters
- Encoding sensitive data character-by-character across multiple requests
ZombieAgent builds on established techniques, such as CamoLeak, and extends them using ChatGPT’s new architecture.
OpenAI response
After disclosure, OpenAI:
- Restricted URL usage to user-provided or publicly indexed domains
- Effectively blocked ZombieAgent-style exfiltration
- Implemented additional (undisclosed) defenses
These mitigations neutralize the PoC — but do not eliminate the underlying class of risk.
The deeper issue
According to Radware, the real problem is architectural:
- AI systems do not distinguish trust levels between:
- User prompts
- Injected content from emails, PDFs, and web pages
- AI lacks intent awareness
- Policy-based fixes are reactive, not structural
“AI is like a baby with a massive brain — very naive, but with access to all your secrets.”
— Pascal Geenens, Radware
Key takeaway
As AI agents become more connected and autonomous, prompt injection is no longer just a novelty attack.
Without:
- Trust boundaries
- Source attribution
- Intent verification
AI assistants risk becoming high-value attack surfaces, especially in enterprise environments.
