Misbehavior1 sourceFirst seen
ChatGPT's Memory Gets a Spyware Upgrade, Because Of Course It Does
Ourtake
The assistant remembered everything except that it was supposed to keep its own secrets, and it kept the attacker's instructions forever.
What happened
Security researcher Johann Rehberger demonstrated that a website could use prompt injection to insert persistent instructions into ChatGPT's memory, causing ongoing exfiltration of user chats through image rendering. The attack worked in the ChatGPT macOS app, which relied on a client-side URL check. OpenAI fixed the vulnerability in version 1.2024.247 in September 2024.