{"schema_version":"0.10.0","id":"LR-2026-0335","record_version":1,"title":"Tenable finds seven ChatGPT vulnerabilities enabling data leaks and persistent hijacking","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":64.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":4.48,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":3,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"c29e8586068fe59f949654bc9840ce583567866507b25376a3f582b5c8a7b566"},"system":{"model_name":"GPT-4o and GPT-5","model_version":null,"developer":"OpenAI","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2025-11-05","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"third_party","summary":"Tenable Research reported seven vulnerabilities in OpenAI's ChatGPT, tested on GPT-4o and GPT-5, which could let an attacker steal personal data from memories and chat histories. The flaws relied on indirect prompt injection, in which hidden instructions placed in web content, search results, links or memory were processed by the model as if they were user requests. One route abused a trusted Bing redirect domain to get past the safe-URL filter. The researchers reported the findings under responsible disclosure to OpenAI. OpenAI has since addressed some of the issues. According to Tenable, several remained unpatched in GPT-5 at the time of reporting, and several proofs of concept still worked on GPT-5. The sources do not report any confirmed real-world exploitation.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"adversarial_input","root_cause_detail":"LLMs cannot reliably distinguish legitimate user instructions from attacker-controlled data ingested from external sources.","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK01","secondary_risks":["RK04","RK15"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Research disclosure with no third party reported as touched, so the minor test is met.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2025/11/researchers-find-chatgpt.html","publisher":"The Hacker News","date":"2025-11-05","type":"press","title":"Researchers Find ChatGPT Vulnerabilities That Let Attackers Trick AI Into Leaking Data - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.linkedin.com/pulse/tenable-uncovers-critical-chatgpt-vulnerabilities-nif3e","publisher":"LinkedIn","date":"2025-11-05","type":"press","title":"Tenable Uncovers Critical Vulnerabilities In ChatGPT - LinkedIn","archived_url":null},{"url":"https://securitybrief.com.au/story/seven-chatgpt-flaws-expose-user-data-to-attack-tenable-warns","publisher":"SecurityBrief Australia","date":"2025-11-06","type":"press","title":"Seven ChatGPT flaws expose user data to attack, Tenable warns - SecurityBrief Australia","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.developer":"C","event.incident_class":"C","event.detection_method":"C","event.trigger":"C","event.root_cause":"C","event.root_cause_detail":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"The seven vulnerabilities and attack techniques, according to Tenable, were found in OpenAI's GPT-4o and GPT-5 models."}],"system.developer":[{"source_index":0,"quote":"The seven vulnerabilities and attack techniques, according to Tenable, were found in OpenAI's GPT-4o and GPT-5 models."}],"event.incident_class":[{"source_index":0,"quote":"Cybersecurity researchers have disclosed a new set of vulnerabilities impacting OpenAI's ChatGPT artificial intelligence (AI) chatbot that could be exploited by an attacker to steal personal information from users' memories and chat histories without their knowledge."}],"event.detection_method":[{"source_index":2,"quote":"Tenable Research has identified seven vulnerabilities in ChatGPT, initially observed in ChatGPT-4o and with several issues persisting in ChatGPT-5, that could allow the theft of personal data and compromise user privacy."}],"event.trigger":[{"source_index":0,"quote":"These issues expose the AI system to indirect prompt injection attacks, allowing an attacker to manipulate the expected behavior of a large language model (LLM) and trick it into performing unintended or malicious actions, security researchers Moshe Bernstein and Liv Matan said in a report shared with The Hacker News."}],"event.root_cause":[{"source_index":0,"quote":"Attack methods such as zero-click ChatGPT data exfiltration via indirect prompt injection also highlight the fundamental problem with LLMs' inability to distinguish between legitimate user instructions and attacker-controlled data ingested from external sources."}],"event.root_cause_detail":[{"source_index":0,"quote":"Attack methods such as zero-click ChatGPT data exfiltration via indirect prompt injection also highlight the fundamental problem with LLMs' inability to distinguish between legitimate user instructions and attacker-controlled data ingested from external sources."}],"impact.severity":[{"source_index":2,"quote":"Tenable Research has identified seven vulnerabilities in ChatGPT, initially observed in ChatGPT-4o and with several issues persisting in ChatGPT-5, that could allow the theft of personal data and compromise user privacy."}],"impact.severity_because":[{"source_index":2,"quote":"Tenable Research has identified seven vulnerabilities in ChatGPT, initially observed in ChatGPT-4o and with several issues persisting in ChatGPT-5, that could allow the theft of personal data and compromise user privacy."}],"event.summary":[{"source_index":0,"quote":"The seven vulnerabilities and attack techniques, according to Tenable, were found in OpenAI's GPT-4o and GPT-5 models."},{"source_index":0,"quote":"These issues expose the AI system to indirect prompt injection attacks, allowing an attacker to manipulate the expected behavior of a large language model (LLM) and trick it into performing unintended or malicious actions, security researchers Moshe Bernstein and Liv Matan said in a report shared with The Hacker News."},{"source_index":0,"quote":"Safety mechanism bypass vulnerability, which takes advantage of the fact that the domain bing[.]com is allow-listed in ChatGPT as a safe URL to set up Bing ad tracking links (bing[.]com/ck/a) to mask malicious URLs and allow them to be rendered on the chat."},{"source_index":1,"quote":"Tenable states they disclosed the vulnerabilities to OpenAI through coordinated channels."},{"source_index":0,"quote":"OpenAI has since addressed some of them."},{"source_index":2,"quote":"While some vulnerabilities have been addressed, Tenable noted that several remain unpatched in ChatGPT-5."}]},"notes_on_gaps":"No date of occurrence is stated; the disclosure date uses the source publication date of 2025-11-05. Sources describe vulnerabilities found by researchers, not a real-world exploitation, so no harm is confirmed and no affected count is stated; the 'hundreds of millions' figure is a potential, not an affected count. Severity minor is my judgement from the research-only nature and absence of any third party touched. Whether ChatGPT acted as an autonomous agent is not stated, so no failure_class was assigned. Which fixes OpenAI made and which controls they added are not stated, so no fix remediation is recorded. Mapping the url_safe bypass to control C4 and the context-isolation failure to C1 is my judgement. The timeline order of undated items is inferred. Responsible party, deployment context, lifecycle stage, country and industry are not stated and are left out. The tools quote keeps the source's curly quotation marks. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"ChatGPT's web browsing and memory functions were studied for data exfiltration routes.","quote":"The research, conducted under responsible disclosure protocols, revealed a series of flaws dubbed collectively as \"HackedGPT\", highlighting multiple routes through which attackers could exfiltrate user data by exploiting ChatGPT's web browsing and memory functions.","source_index":2,"grade":"C"},{"step":"went_wrong","text":"Hidden instructions in online content could be followed by the model.","quote":"Central to Tenable's findings is a security weakness known as indirect prompt injection.","source_index":2,"grade":"C"},{"step":"reached","text":"The model could be coerced into unauthorised actions by retrieving web data.","quote":"This means that the model can be coerced into taking unauthorised actions simply by retrieving data from the web, thereby bypassing user intent and safety restrictions.","source_index":2,"grade":"C"},{"step":"caught","text":"Tenable Research found the flaws and reported them under responsible disclosure.","quote":"Tenable Research has identified seven vulnerabilities in ChatGPT, initially observed in ChatGPT-4o and with several issues persisting in ChatGPT-5, that could allow the theft of personal data and compromise user privacy.","source_index":2,"grade":"C"},{"step":"done","text":"OpenAI resolved some flaws; others were still open at the time of reporting.","quote":"While OpenAI has resolved some of the vulnerabilities, others remained unaddressed at the time of reporting, leaving certain exploit paths accessible to potential attackers.","source_index":2,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2025/11/researchers-find-chatgpt.html","https://www.linkedin.com/pulse/tenable-uncovers-critical-chatgpt-vulnerabilities-nif3e","https://securitybrief.com.au/story/seven-chatgpt-flaws-expose-user-data-to-attack-tenable-warns"]},"analysis":{"sections":{"timeline":[{"text":"Tenable disclosed the vulnerabilities to OpenAI through coordinated channels.","quote":"Tenable states they disclosed the vulnerabilities to OpenAI through coordinated channels.","source_index":1,"when":null},{"text":"Some vulnerabilities were addressed via published Technical Research Advisories.","quote":"Some vulnerabilities have been addressed via published Technical Research Advisories (TRAs) — e.g., TRA-2025-22, TRA-2025-11, TRA-2025-06.","source_index":1,"when":null},{"text":"OpenAI addressed some of the vulnerabilities after disclosure.","quote":"OpenAI has since addressed some of them.","source_index":0,"when":null},{"text":"Tenable noted several vulnerabilities remained unpatched in ChatGPT-5.","quote":"While some vulnerabilities have been addressed, Tenable noted that several remain unpatched in ChatGPT-5.","source_index":2,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2025/11/researchers-find-chatgpt.html","https://www.linkedin.com/pulse/tenable-uncovers-critical-chatgpt-vulnerabilities-nif3e","https://securitybrief.com.au/story/seven-chatgpt-flaws-expose-user-data-to-attack-tenable-warns"]}}