Blog Published: Jul 7, 2026

AgentFlayer Turns ChatGPT Connectors Into a Zero-Click Exfiltration Path

Zenity showed how an untrusted document can tell ChatGPT connectors (connections that let ChatGPT read authorized SaaS data such as Google Drive) to search for API keys, place them inside a markdown image URL, and leak them when the client renders a safe-looking Azure Blob (Microsoft Azure object storage) image. The core lesson is value-level data-flow control: connector data may be readable for a task, but that does not mean it can be embedded into remote media.

Indirect Prompt InjectionData ExfiltrationSink EnforcementAgentic AIEnterprise AI
7 applicable AIDEFEND defenses
Source: AgentFlayer: ChatGPT Connectors 0click Attack 
Author: Tamir Ishay Sharbat
Original article: Aug 6, 2025

Threat Analysis

  • The document carries the instruction. The attacker hides prompt-injection text in a file the victim uploads to ChatGPT for summarization or analysis.
  • The task changes without user approval. Instead of summarizing the document, ChatGPT is instructed to search connected Google Drive for API keys and keep the change quiet.
  • The connector supplies the sensitive value. ChatGPT uses the victim's connector authorization to retrieve API-key material from Drive or another connected SaaS source.
  • The renderer becomes the exfiltration sink. The output places the keys inside a markdown image URL. When the image renders, the request sends the keys as URL parameters.
  • Safe-looking domains are not enough. Zenity's bypass used Azure Blob plus Log Analytics, showing that URL checks must inspect data flow and full destination context, not only domain reputation.

Applicable AIDEFEND Defenses (7)

AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
Very High
This is the central control. Connector outputs that look like API keys should be tagged as sensitive values and blocked from flowing into markdown image URLs, remote media, model calls, or external HTTP requests.
AID-H-018.004
Intent-Based Dynamic Capability Scoping
Very High
A document-summary request should not grant Drive-wide secret search. The connector dispatcher should derive the allowed tools from the trusted user request, not from hidden document text.
AID-H-019.001
URL Normalization & Allowlist Filtering
Very High
The Azure Blob bypass shows that the full canonical URL, path, query parameters, and relay behavior must be checked. A reputable host is not safe if the URL carries secret material.
AID-H-006.002
Text, Markup & Structured Output Sanitization and Release Gate
High
Generated markdown and remote media should be sanitized before rendering. URL validation must happen before the browser or client sends the image request.
AID-H-029.002
Lifecycle-Stage Authorization Gate
High
Connected SaaS files should carry data-use tags. Secrets or high-sensitivity documents should not be admitted into this inference context unless the user purpose explicitly authorizes it.
AID-D-003.002
Sensitive Information & Data Leakage Detection
High
Scan the model-generated answer, Markdown image source, and URL parameters for API-key patterns before release. This control emits a sensitive-output finding; AID-H-006.002 or AID-H-018.005 must consume it to block rendering or network release.
AID-E-001.001
Root & Long-Lived Credential Object Eviction
High
If leaked API keys, client secrets, or developer credentials may have exited through a rendered image request, the exact long-lived credential objects must be revoked and rotated at their authoritative issuers. Secret-leak detections should trigger that eviction automatically, because these are long-lived credential objects rather than issued sessions.

What Defenders Should Do Now

  • Separate uploaded-document context from connector authority. A file should not be able to expand a task into Drive, SharePoint, OneDrive, GitHub, or email search by itself.
  • Tag connector outputs by source and sensitivity, then block high-sensitivity values from remote media, URLs, messages, and model-call bodies.
  • Inspect generated markdown before rendering. Treat images, links, previews, and remote media as network actions, not harmless formatting.
  • Log connector search, generated URL, and render events together so teams can detect document-to-connector-to-image exfiltration chains.
  • Prepare key rotation workflows for API keys, OAuth tokens, and developer secrets exposed through AI connectors.

Conclusion

AgentFlayer is powerful because every step looks like a normal feature: upload a document, search a connector, render an image. The security boundary has to follow the data, not the feature label. Once a sensitive connector value appears, it needs policy before it can become a URL, an image, or any other network side effect.