ChatGPT Conversation Exfiltration via Indirect Prompt Injection
ChatGPT
A researcher demonstrated that indirect prompt injections on public websites could trick ChatGPT into rendering markdown images with embedded chat logs. This caused automatic requests to external servers, successfully exfiltrating user conversation data.
- first report
- 30 Oct 2023
- last update
- 30 Oct 2023
Timeline · 2
Sources · 2
News and write-ups
- 2023-10-30ChatGPT Plugins: Data Exfiltration via Images & Cross Plugin Request ForgeryEmbrace The Red · embracethered.com/blog/posts/2023/chatgpt-webpilot-data-exfil-via-markdown-injec
Research and catalogues
- 2023-10-30ChatGPT Conversation ExfiltrationMITRE ATLAS · atlas.mitre.org/studies/AML.CS0021
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionData leak
- severity
- 1 · Research / proof of concept
- targets
- OpenAI
- mitre atlas
- AML.T0051 LLM Prompt Injection
- dates
- happened May 2023 (approx.) · first reported 30 Oct 2023
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# ChatGPT Conversation Exfiltration via Indirect Prompt Injection https://gcdradar.vercel.app/incidents/chatgpt-conversation-exfiltration-via-indirect-prompt-inject · AIR-2023-0003 · closed 2023-11-13 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2023-10-30 (happened 2023-05) - AI role: Attack on AI - Products: ChatGPT ## Summary A researcher demonstrated that indirect prompt injections on public websites could trick ChatGPT into rendering markdown images with embedded chat logs. This caused automatic requests to external servers, successfully exfiltrating user conversation data. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2023-10-30: ChatGPT Plugins: Data Exfiltration via Images & Cross Plugin Request Forgery (https://embracethered.com/blog/posts/2023/chatgpt-webpilot-data-exfil-via-markdown-injection) - 2023-10-30: ChatGPT Conversation Exfiltration (https://atlas.mitre.org/studies/AML.CS0021) ## Sources - 2023-10-30 MITRE ATLAS: ChatGPT Conversation Exfiltration https://atlas.mitre.org/studies/AML.CS0021 - 2023-10-30 Embrace The Red: ChatGPT Plugins: Data Exfiltration via Images & Cross Plugin Request Forgery https://embracethered.com/blog/posts/2023/chatgpt-webpilot-data-exfil-via-markdown-injection Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedChatGPT ChatGPT Account Compromise Leads to Exposure of Private Chat Logs
Breaches & attacks · Exploited · since 30 Jan 2024
AI - closedBing Chat Bing Chat Data Exfiltration via Indirect Prompt Injection
Research · since 2023 (approx.)
AI - closedBing Chat Bing Chat Initial Instructions Exposed via Prompt Injection by Testers
Research · since 8 Feb 2023
AI - closedChatGPT LLM Application Frameworks Allow Remote Code Execution via Prompting
Research · since 26 Mar 2023 · updated 31 Mar 2023
AI - closedChatGPT ChatGPT Bug Exposes User Chat Histories and Payment Data
Breaches & attacks · Real loss · since 20 Mar 2023
AI - closedChatGPT Samsung Source Code and Meeting Records Disclosed via ChatGPT Ingestion
Breaches & attacks · Real loss · since 11 Mar 2023
AI