A shared document quietly pulled API keys out of ChatGPT

Zenity Labs demonstrated at Black Hat USA in August 2025 that a document shared to a victim's Google Drive could make ChatGPT search the drive for API keys and send them to an attacker, with no action by the victim beyond having the connector enabled. The company called the technique AgentFlayer.

The malicious document contained instructions in tiny white text asking the assistant to ignore the user's request, look for files containing API keys, and append what it found to an image URL. When the victim asked ChatGPT to summarise the document, or in some variants any document, the assistant fetched the image, which sent the keys to the attacker's server.

OpenAI's connectors already blocked many external image domains. Zenity found that Azure Blob Storage URLs were allowed, and used one to receive the data. Wired reported that OpenAI put mitigations in place after the researchers disclosed the issue earlier in the year.

Zenity presented similar findings against Microsoft Copilot Studio, Salesforce Einstein and Cursor at the same conference, arguing that agents with access to enterprise data and outbound network capability need policy controls independent of the model.

The AgentFlayer research is frequently grouped with EchoLeak and ShadowLeak as the 2025 demonstrations that established zero-click exfiltration as a practical threat to assistant products, rather than a theoretical concern.