{
 "id": "AIR-2023-0003",
 "slug": "chatgpt-conversation-exfiltration-via-indirect-prompt-inject",
 "title": "ChatGPT Conversation Exfiltration via Indirect Prompt Injection",
 "summary": "A researcher demonstrated that indirect prompt injections on public websites could trick ChatGPT into rendering markdown images with embedded chat logs. This caused automatic requests to external servers, successfully exfiltrating user conversation data.",
 "type": "attack_on_ai",
 "categories": [
  "prompt_injection",
  "data_leak"
 ],
 "severity": 1,
 "targets": [
  "OpenAI"
 ],
 "products": [
  "ChatGPT"
 ],
 "incident_date": "2023-05",
 "incident_date_precision": "month",
 "first_reported": "2023-10-30",
 "sources": [
  {
   "url": "https://atlas.mitre.org/studies/AML.CS0021",
   "publisher": "MITRE ATLAS",
   "title": "ChatGPT Conversation Exfiltration",
   "published_at": "2023-10-30"
  },
  {
   "url": "https://embracethered.com/blog/posts/2023/chatgpt-webpilot-data-exfil-via-markdown-injection",
   "publisher": "Embrace The Red",
   "title": "ChatGPT Plugins: Data Exfiltration via Images & Cross Plugin Request Forgery",
   "published_at": "2023-10-30"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_atlas",
 "tags": [
  "indirect_prompt_injection",
  "data_exfiltration",
  "chatgpt"
 ],
 "created_at": "2026-10-18T06:55:08.239Z",
 "updated_at": "2026-10-18T06:55:08.239Z"
}