Radware Uncovers Zero-Click Vulnerability In ChatGPT Deep Research Agent

Radware has disclosed a zero-click, service-side vulnerability in OpenAI’s ChatGPT Deep Research agent, warning enterprises that Ai-powered services face risks that bypass traditional security tools.

The flaw, named ShadowLeak, was discovered by Radware’s Security Research Center and demonstrated how attackers could exfiltrate sensitive customer data without any action from the user.

How ShadowLeak Works

Researchers found that attackers could trigger the exploit by sending a single malicious email. Once ChatGPT’s Deep Research agent engaged with the message, the system autonomously extracted data from OpenAI servers. Victims were not required to open, click or even view the email.

“This is the quintessential zero-click attack,” said David Aviv, Chief Technology Officer at Radware. “There is no user action required, no visible cue and no way for victims to know their data has been compromised. Everything happens entirely behind the scenes through autonomous agent actions on OpenAI cloud servers.”

The exploit differs from previous zero-click attacks because it is fully server-side. No network-level evidence is left behind, making detection extremely difficult for business customers relying on standard monitoring tools.

A New Class Of Threats

The discovery highlights emerging risks as Ai agents take on autonomous roles in business workflows.

“Enterprises adopting Ai cannot rely on built-in safeguards alone to prevent abuse,” said Pascal Geenens, Director of Cyber Threat Intelligence at Radware. “Our research highlights that the combination of Ai autonomy, SaaS services and integration with customers’ sensitive data sources introduces an entirely new class of risks. Ai-driven workflows can be manipulated in ways not yet anticipated, and these attack vectors often bypass the visibility and detection capabilities of traditional security solutions.”

Radware researchers Gabi Nakibly and Zvika Babo, with contributions from Maor Uziel, led the discovery.

Enterprise Impact

The timing coincides with growing enterprise use of ChatGPT. In August 2025, OpenAI Vice President of Product, Nick Turley, told CNBC that ChatGPT had 5 million paying business users.

Radware’s findings suggest that reliance on vendor controls alone may leave organisations exposed. Security teams will need to adapt their defences to account for autonomous Ai behaviours.

Disclosure And Fix

Radware reported the vulnerability to OpenAI on 18 June 2025 under responsible disclosure protocols. OpenAI acknowledged the issue and confirmed a fix on 3 September 2025.

Radware said it welcomed OpenAI’s cooperation. The company stressed that the research was conducted to give security professionals the same insights as attackers.

Next Steps

The full findings will be presented in a Radware webinar on 16 October 2025, titled ShadowLeak: A Deep Dive into the First Zero-Click, Service-Side Vulnerability in ChatGPT. The session will cover the anatomy of the exploit, best practices for securing Ai agents and the outlook for responsible threat research.

Radware has also published a detailed threat advisory and technical blog on ShadowLeak. Both include recommendations for defence strategies and will be available through its Security Research Center.

“This discovery reinforces our commitment to anticipating threats that traditional tools miss,” said Aviv. “Ensuring Ai agents operate within safe, secure and trusted boundaries is now critical for enterprises.”

Last Updated on September 19, 2025 by Nick Ross