Blog Published: Aug 2, 2026

ZombieAgent Shows How Connector Prompt Injection Can Persist and Spread

Radware showed how hidden instructions in email or documents read through ChatGPT connectors could turn a task into data exfiltration. Fixed URLs encoded stolen text one character per request, Memory preserved instructions across chats, and a contact-harvesting branch spread the payload; Radware says OpenAI fixed it on December 16, 2025. Workspace administrators can disable unnecessary connectors or Memory and narrow or revoke grants, while platform implementers own raw-content isolation, Memory gates, and default-deny egress; value-level sink checks cover only explicit transfers retaining server-side content IDs.

Indirect Prompt InjectionData ExfiltrationSink EnforcementSession IsolationAgentic AI
6 applicable AIDEFEND defenses
Source: ZombieAgent: New ChatGPT Vulnerabilities Let Data Theft Continue (and Spread) 
Author: Zvika Babo
Original article: Jan 8, 2026

Threat Analysis

  • A normal connector task delivers the instruction. The attacker hides a prompt in an email or document. When a later user request causes ChatGPT to retrieve that source, the model can treat the hidden text as authority.
  • Static URLs carry the stolen value. The prompt supplies a fixed URL alphabet. The model selects one existing URL per character, and the resulting request sequence encodes sensitive text without constructing or modifying a URL.
  • Memory turns one retrieval into persistence. A malicious source can instruct ChatGPT to save a recurring trigger and collected sensitive information in Memory, allowing the behavior to reappear in later chats.
  • Contact theft enables propagation. One branch extracts recent email addresses. The attacker's server, not ChatGPT itself, then sends the malicious email to those recipients.
  • This was controlled research. Radware says OpenAI fixed the reported issue on December 16. OpenAI later described source-sink analysis and Safe Url defenses, but public material does not establish that every persistence and propagation variant was eliminated.

Applicable AIDEFEND Defenses (6)

AID-H-017.007
Dual-LLM Isolation Pattern
Very High
Send raw email, documents, and connector content only to a quarantined model with no privileged tools. A validating broker may release only allowlisted domain fields and opaque record identifiers in a signed envelope; a generic free-text summary is not a security boundary. The privileged model never receives the original attacker text, and every proposal still goes through the executor's authorization checks.
AID-I-004.004
Transactional Promotion Gates (Quarantine -> Trusted)
Very High
Externally influenced content must not write directly into trusted Memory. Store proposed memories in quarantine with tenant, source, content digest, and target namespace, then require a content-bound approval and controlled-writer receipt before atomic promotion. Prompt assembly must exclude every pending or rejected state.
AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
High
Put URL fetches, remote subresources, and outbound mail behind default-deny provider egress with a change-managed destination allowlist. For explicit value transfers that already carry a server-side content identifier, apply the labelled sink policy at dispatch. This blocks the attacker domain in the demonstrated chain, but the current guidance does not automatically track the implicit flow in which a secret character selects one prebuilt URL.
AID-H-018.004
Intent-Based Dynamic Capability Scoping
High
Register connector read, Memory write, web open, and outbound message as distinct tool names. Derive the signed set of allowed names, action budget, and expiry from the authenticated user's visible request, so an inbox-reading task cannot acquire unrelated tools from retrieved text. This guidance does not constrain mailbox resources or result cardinality inside one broadly designed connector operation.
AID-D-001.005
Recalled Memory Pre-Rehydration Scanning
Medium
Before any saved Memory record re-enters prompt assembly, scan the exact versioned content for authority claims, delayed triggers, encoded fragments, and known quarantine fingerprints. Bind the finding to the tenant, record version, content digest, detector revision, and policy. This detector only recommends a disposition; a downstream Harden or Isolate policy must decide and enforce blocking or quarantine.
AID-H-006.002
Text, Markup & Structured Output Sanitization and Release Gate
Medium
For the renderer-based branch, hold generated output until remote subresources and URLs have passed sink-specific policy. Remove or proxy unapproved images and previews, disable automatic fetches, and verify with browser-egress tests that Markdown, HTML, CSS, SVG, and reference links cannot silently trigger the fixed-URL requests.

What Defenders Should Do Now

  • Workspace administrators: inventory which workspaces expose email, document, and storage connectors and which users have Memory enabled. Disable unused features, reduce OAuth and data scopes, and revoke grants that are no longer required.
  • Platform implementers: keep raw email and document text away from the tool-capable model. Use a no-tool quarantined model plus a validating broker that releases only allowlisted domain fields and opaque record IDs; reject generic free-text summaries.
  • Platform implementers: bind every request to the user's original intent. A read or summary task should not gain contact search, Memory write, external fetch, remote-media, or messaging authority without a separate trusted action.
  • Platform implementers: quarantine every memory proposed from external content. Require a content-bound promotion decision, and make the recall policy consume detector findings before prompt assembly.
  • Platform implementers: default-deny outbound URLs and remote subresources. Test fixed URL alphabets, one-character request sequences, Markdown images, previews, redirects, approved-domain abuse, and repeated server-side fetches.
  • Incident responders: preserve connector, Memory, URL-fetch, and outbound-message evidence; remove suspicious memories; revoke affected connector grants; review recently accessed data and contacts; and notify recipients of attacker-sent messages.

1 additional consideration

Control-dependent fixed-URL encoding

The current content-ID sink guidance can govern explicit labelled value transfers, but it does not automatically propagate a secret label when each secret character only determines which already valid URL is selected. Destination allowlisting blocks the demonstrated attacker domain, not every covert sequence over an approved destination.
Recommendation: Add application-specific control-dependence tracking or a fail-closed rule that forbids model-selected remote requests from connector-derived content. Test URL alphabets, request ordering and rate, redirects, approved-domain abuse, and server-side fetch paths as separate cases.

Conclusion

ZombieAgent combines three boundaries that must be enforced separately: untrusted connector content, durable assistant memory, and outbound network effects. Fixing one URL-construction path does not make retrieved text trustworthy or a memory write safe. A resilient design isolates raw content, requires explicit promotion into trusted memory, makes downstream policy act on every recall finding, and blocks unapproved egress while testing the fixed-URL control-flow channel separately.