ShadowLeak Zero-Click Flaw Leaks Gmail Data via OpenAI ChatGPT Deep Research Agent

Cybersecurity researchers have disclosed a zero-click flaw in OpenAI ChatGPT's Deep Research agent that could allow an attacker to leak sensitive Gmail inbox data with a single crafted email without any user action. The new class of attack has been codenamed ShadowLeak by Radware. Following...

@circleci/agents (>=1.0.6, <=2.10.0), @digipair/skill-codex (>=0.99.1, <=0.143.0) +3 more potentially affected by CVE-2025-59532 via @openai/codex (>=0.8.0, <=0.29.0)

@openai/codex NPM version =0.8.0, =1.0.6, =0.99.1, =0.0.1, =0.1.0, =0.99.1, =0.143.0 Source cves: CVE-2025-59532 Source advisory: OSV:GHSA-W5FX-FH39-J5RW...

ChatGPT Deep Research zero-click vulnerability fixed by OpenAI

OpenAI has moved quickly to patch a vulnerability known as “ShadowLeak” before anyone detected real-world abuse. Revealed by researchers yesterday, ShadowLeak was an issue in OpenAI’s Deep Research project that attackers could exploit by simply sending an email to the target. Deep Research was...

PT-2025-39504

Summary An arbitrary file read vulnerability in the chatId parameter supplied to both the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints allows unauthenticated users to read unintended files on the local filesystem. In the default Flowise configuration this allows...

Breaking Android with AI: a Deep Dive into LLM-Powered Exploitation

The rapid evolution of Artificial Intelligence AI and Large Language Models LLMs has opened up new opportunities in the area of cybersecurity, especially in the exploitation automation landscape and penetration testing. This study explores Android penetration testing automation using LLM-based...

Malicious code in text-openai-embedding-js (npm)

The package text-openai-embedding-js was found to contain malicious code...

MAL-2025-46308 Malicious code in text-openai-embedding-js (npm)

The package text-openai-embedding-js was found to contain malicious code...

The Ongoing Fallout from a Breach at AI Chatbot Maker Salesloft

The recent mass-theft of authentication tokens from Salesloft , whose AI chatbot is used by a broad swath of corporate America to convert customer interaction into Salesforce leads, has left many companies racing to invalidate the stolen credentials before hackers can exploit them. Now Google war...

Someone Created the First AI-Powered Ransomware Using OpenAI's gpt-oss:20b Model

Cybersecurity company ESET has disclosed that it discovered an artificial intelligence AI-powered ransomware variant codenamed PromptLock. Written in Golang, the newly identified strain uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts in real-tim...

Someone Created the First AI-Powered Ransomware Using OpenAI's gpt-oss:20b Model

Cybersecurity company ESET has disclosed that it discovered an artificial intelligence AI-powered ransomware variant codenamed PromptLock. Written in Golang, the newly identified strain uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts in real-tim...

Malicious code in openai-realtime-console-plugin (npm)

The package openai-realtime-console-plugin was found to contain malicious code...

MAL-2025-28317 Malicious code in openai-realtime-console-plugin (npm)

The package openai-realtime-console-plugin was found to contain malicious code...

The vulnerability of the Azure OpenAI cloud platform, related to insufficient validation of incoming requests, allows a hacker to escalate their privileges.

The vulnerability of the Azure OpenAI cloud platform is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

CVE-2025-53767

Azure OpenAI Elevation of Privilege Vulnerability...

CVE-2025-53767

Azure OpenAI Elevation of Privilege Vulnerability...

CVE-2025-53767 Azure OpenAI Elevation of Privilege Vulnerability

...

CVE-2025-53767 Azure OpenAI Elevation of Privilege Vulnerability

...

CVE-2025-53767

Azure OpenAI CVE-2025-53767 is an elevation-of-privilege vulnerability rated CVSS v3.1 base score 10 (NETWORK, LOW attack complexity, PR NONE, UI NONE, C:H/I:H/A:N, scope CHANGED). It affects Azure OpenAI and can grant elevated rights with no user interaction. Microsoft has published updates via ...

Azure OpenAI Elevation of Privilege Vulnerability

...

PT-2025-32313

Name of the Vulnerable Software and Affected Versions: Azure OpenAI affected versions not specified Description: An elevation of privilege issue exists in Azure OpenAI. Successful exploitation could allow an attacker to gain elevated privileges. Recommendations: At the moment, there is no...