Feb 1, 2025Single source
ChatGPT Operator vulnerable to prompt injection leading to data leaks and unwanted actions
AI loose in the worldInjectionDERIVED
Approved by person, Oct 12, 2026. How entries are approved
Security researcher Johann Rehberger documented critical prompt-injection vulnerabilities in ChatGPT Operator, the browser-using agent, showing hidden instructions on web pages could hijack the agent's actions - enabling data exfiltration and unauthorized purchases. The work underlined that prompt injection against autonomous agents is effectively unsolvable with current defenses.
What this means for youHome: AI agents that browse and buy things for you can be tricked by hidden text on a web page, so do not give them payment access without a confirmation step. Work: treat outputs from browsing agents as untrusted until a person checks them. Government: agencies using such agents need limits on what they can access and spend.
Sources
- Embrace The Red (Johann Rehberger)https://embracethered.com/blog/posts/2025/chatgpt-operator-prompt-injection-exploits/
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2415. It has not been edited since it was approved; the hash above would not match if it had. How to verify