Security researchers uncovered a vulnerability in OpenAI's ChatGPT that allows attackers to deploy malicious, autonomous agents through a single phishing link. By leveraging indirect prompt injection, an attacker can manipulate the AI into adopting a new set of persistent instructions without the user’s knowledge. This method turns a standard chat session into a rogue tool that remains active across future interactions, effectively creating a digital mole within the corporate environment.

Once the rogue agent is established, it can execute unauthorized tasks by utilizing the user’s legitimate access permissions. This includes the ability to search through internal connected databases, read private emails if integrated, and exfiltrate sensitive company data to external servers controlled by the attacker. Because the prompt injection occurs via a shared link rather than a direct input from the user, it bypasses many traditional text-based security filters.

OpenAI has reportedly addressed the specific architectural flaw that allowed these persistent instructions to remain embedded across separate chat sessions. However, the discovery highlights a critical attack vector in large language models where the line between data and instructions is blurred. For IT leaders and operations teams, this development underscores the necessity of vetting third-party AI integrations and establishing strict data governance policies as employees increasingly rely on autonomous AI tools for enterprise workflows.