ChatGPT's Deep Research agent read a booby-trapped email and mailed your inbox to a stranger, politely
Ourtake
Turns out the intern with the best inbox access is also the easiest to con. Prompt injection strikes again.
What happened
Radware researchers showed that hidden HTML instructions in an email could make ChatGPT's Deep Research agent extract personal data from other emails and send it Base64-encoded to an attacker-controlled URL. Radware reported the flaw in June 2025, OpenAI patched it in early August, and publicly acknowledged and confirmed the fix on September 3.