ChatGPT Operator zero-interaction data exfiltration

What happened

Hidden instructions planted on a web page could hijack Operator as it browsed, causing it to navigate to attacker pages and leak PII from authenticated sessions with no user interaction.

Root cause

The agent followed links and interacted with form fields on untrusted pages without sufficient scrutiny, treating page content as instructions.

Fix / outcome

Demonstrated to OpenAI; mitigations reduce but do not eliminate the risk. The researcher framed agents as potential "malicious insiders."

Sources