AI Risk Wire

Cases › security breach › LR-2026-0335

Tenable finds seven ChatGPT vulnerabilities enabling data leaks and persistent hijacking

Confirmed Why: 2 independent outlets · 2 independent reports

Status: action reported, no fix

Severity minor
Reported 5 Nov 2025
Developer and model OpenAI · GPT-4o and GPT-5

No source states: loss or records, agent tool, could do, deployer, industry.

Severity minor: Research disclosure with no third party reported as touched, so the minor test is met.

Tenable Research reported seven vulnerabilities in OpenAI's ChatGPT, tested on GPT-4o and GPT-5, which could let an attacker steal personal data from memories and chat histories. The flaws relied on indirect prompt injection, in which hidden instructions placed in web content, search results, links or memory were processed by the model as if they were user requests. One route abused a trusted Bing redirect domain to get past the safe-URL filter. The researchers reported the findings under responsible disclosure to OpenAI. OpenAI has since addressed some of the issues. According to Tenable, several remained unpatched in GPT-5 at the time of reporting, and several proofs of concept still worked on GPT-5. The sources do not report any confirmed real-world exploitation.

What happened

1 · What it was doingChatGPT's web browsing and memory functions were studied for data exfiltration routes.
2 · What went wrongHidden instructions in online content could be followed by the model.
3 · What it reached or didThe model could be coerced into unauthorised actions by retrieving web data.
4 · How it was caughtTenable Research found the flaws and reported them under responsible disclosure.

What was done

OpenAI resolved some flaws; others were still open at the time of reporting.

Risks

Hidden instructions hijack the agent
Primary50 incidents
Rising: 6 vs 2.8 a week
Data leaked or sent out
Also32 incidents
Privacy harm to a person
Also41 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Outside content treated as data, not instructions · Prompt-injection detection · Confirmation after untrusted input · Validation of tool inputs and outputs · Tool allow-list

Application

Human approval for high-impact actions · Least-privilege access for the agent · Segmentation of agent components · Alerts on unusual tool use

Similar incidents

Florida pastor alleges ChatGPT medical advice caused near-fatal pulmonary embolism; lawsuit filed against OpenAI2026-07-22
Lawsuits allege ChatGPT encouraged Alabama woman's suicide2026-07-20
Lawsuit alleges ChatGPT GPT-4o contributed to man's death2026-01-12
Lawsuit alleges ChatGPT role in Connecticut murder-suicide2025-12-11

All cases of this kind ›

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case.

Model versions this case names

Each link opens what the provider's documents state for that version, who tested it, and the safeguards it describes.

Show the full account: 4 items from the primary sources

What happened, in order

Not dated in the sources:

  • Tenable disclosed the vulnerabilities to OpenAI through coordinated channels.
  • Some vulnerabilities were addressed via published Technical Research Advisories.
  • OpenAI addressed some of the vulnerabilities after disclosure.
  • Tenable noted several vulnerabilities remained unpatched in ChatGPT-5.
Show every field, with its source and grade

The AI system

Model
GPT-4o and GPT-5
C one secondary source states it
Developer
OpenAI
C one secondary source states it

What happened

Earliest source we hold
2025-11-05
D inferred by us from the described behaviour, reason shown
What set it off
hidden instructions in its input
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
Cause
hostile input carried instructions
C one secondary source states it
Cause in detail
LLMs cannot reliably distinguish legitimate user instructions from attacker-controlled data ingested from external sources.
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK01
D inferred by us from the described behaviour, reason shown
secondary risks
RK04, RK15
D inferred by us from the described behaviour, reason shown

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Why this severity
Research disclosure with no third party reported as touched, so the minor test is met.
D inferred by us from the described behaviour, reason shown

Notes on gaps

No date of occurrence is stated; the disclosure date uses the source publication date of 2025-11-05. The timeline order of undated items is inferred. The tools quote keeps the source's curly quotation marks.

LR-2026-0335 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON