AGENTFLAYER: CHATGPT CONNECTORS 0CLICK ATTACK

Summary from the TLDR AI newsletter

Researchers discovered a zero-click attack exploiting ChatGPT's connector feature to steal data from Google Drive and other services. Attackers embed invisible prompt injections in documents that, when uploaded to ChatGPT, instruct the AI to search connected drives and embed stolen data in image URLs. The malicious prompts then embed stolen data as URL parameters in rendered images hosted on trusted Azure Blob storage.