Sep 20, 2024Single source
'SpAIware': ChatGPT memory poisoning turned the assistant into a persistent spy, exfiltrating every future chat
AI loose in the worldData exfiltrationDERIVED
Approved by person, Oct 11, 2026. How entries are approved
Johann Rehberger (Embrace The Red) demonstrated 'SpAIware': a malicious website uses indirect prompt injection to invoke ChatGPT's memory tool and plant a persistent instruction that appends the user's chat data into image-render URLs pointing at an attacker's server. Every future conversation is then silently exfiltrated, across sessions. OpenAI had earlier dismissed memory manipulation as a non-security issue before the end-to-end proof of concept.
What this means for youAt home: a booby-trapped web page could make ChatGPT's memory quietly leak your later chats. At work: avoid pasting confidential data into assistants with memory on. In government: shows why vendors must treat memory manipulation as a security flaw.
Sources
- Embrace The Red (Johann Rehberger)https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2377. It has not been edited since it was approved; the hash above would not match if it had. How to verify