# Spyware Injection Into Your ChatGPT's Long-Term Memory (SpAIware)

Prompt injection from untrusted web content stored spyware instructions in ChatGPT's long-term memory, persistently exfiltrating all future chat data via invisible image rendering.

- Payout: Research
- Severity: high
- Program: OpenAI
- Write-up by: Johann Rehberger
- Disclosed: 2024-09-20
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-macos-app-persistent-data-exfiltration
- Tags: area:ai domain:ai domain:desktop impact:data-leak impact:pii-leak kind:research platform:research sev:high tech:llm technique:chained technique:incomplete-fix vuln:prompt-injection

**Target:** ChatGPT macOS desktop app (memory feature + image rendering)
**Root cause:** Client-side url_safe check for image rendering can be bypassed, and the memory tool accepts attacker-controlled instructions from untrusted content, persisting them across sessions.
**Steps:**
1. Host a webpage/document containing a prompt injection that invokes the memory tool to store exfiltration instructions.
2. Victim opens the untrusted page/document in ChatGPT macOS app; injection writes a malicious memory.
3. Memory instructs ChatGPT to render an invisible image to attacker server with chat data as query parameter on every future message.
4. Attacker server logs query params to harvest all typed input and responses across sessions.
**How found:** Prior research showed url_safe was client-side and bypassable on iOS/Android/macOS; the new Memory feature was hypothesized to persist injected instructions across sessions, turning one-shot exfiltration into persistent spyware.
**Exploitation:** Attacker-controlled website or document injects a memory containing instructions to render an invisible image pointing at an attacker server, appending user chat content as query parameters; persists across all future conversations until memory is deleted.
**Escalation:** Memory persistence converts a single-session exfiltration into continuous cross-session spyware and a potential C2 channel to update instructions.
**Insight:** When a vendor adds a stateful feature (memory, history, profiles) to an LLM app, re-test prior prompt-injection exfil vectors: injected instructions can now persist and re-trigger automatically, and client-side safety checks like url_safe are bypassable.