ShadowLeak. The access path.
A hidden line in an email made ChatGPT's research agent exfiltrate from OpenAI's own servers. Every control the victim owned sat on a network the request never touched.
The record
Entry point. inbound email, injection hidden in HTML styling, sitting unread in the inbox.
The identity in the middle. The victim's Gmail connector grant inside ChatGPT. The agent read the mailbox with the user's delegated access, and the outbound request came from OpenAI infrastructure rather than the user's device.
What was reached. personal data, base64 encoded into that URL and sent from OpenAI's cloud, invisible to the victim's network.
A hidden line in an email made ChatGPT's research agent exfiltrate from OpenAI's own servers.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| inbound email | Entry | injection hidden in HTML styling, sitting unread in the inbox |
| Deep Research run | Step | the user starts a normal research task with the Gmail connector on |
| connector grant | Step | the agent reads the mailbox with the user's delegated access |
| browsing tool | Step | injected instructions make the agent open an attacker URL |
| personal data | Reached | base64 encoded into that URL and sent from OpenAI's cloud, invisible to the victim's network |
Where a breakpoint would have been
The connector grant and its scope, because it is the only part of this path a customer controls. The browsing tool and the server side egress belong to the provider. What a tenant can decide is which mailboxes, drives and workspaces a research agent may read at all.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the ShadowLeak incident?
The published path starts at inbound email, injection hidden in HTML styling, sitting unread in the inbox.
What did it reach?
The last step in the published path is personal data, base64 encoded into that URL and sent from OpenAI's cloud, invisible to the victim's network.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.