# ChatGPT Operator: Prompt Injection Exploits & Defenses

Prompt injection in a GitHub issue hijacked ChatGPT Operator to read private PII from authenticated sites and type it into an attacker page that exfiltrates on keystroke.

- Payout: Research
- Severity: high
- Program: OpenAI
- Write-up by: Johann Rehberger
- Disclosed: 2025-02-17
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/chatgpt-operator-prompt-injection-exploits/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits
- Tags: area:ai domain:ai impact:data-leak impact:pii-leak kind:research platform:research sev:high tech:llm technique:chained technique:recon vuln:prompt-injection

**Target:** OpenAI ChatGPT Operator browser agent (web browsing / computer-use)
**Root cause:** Operator treats instructions embedded in web page content (a GitHub issue) as trusted task directives, so adversarial text can redirect the agent to authenticated pages and exfiltrate data; mitigations only probabilistically gate dangerous actions.
**Steps:**
1. Create attacker page that POSTs every keystroke/input to attacker server without needing a submit button.
2. Host prompt injection payload as a GitHub issue containing a fake 'combine' tool link pointing to the attacker page.
3. Give Operator the issue URL (or 'Investigate this GitHub issue').
4. Operator clicks the link, navigates to attacker page, types a test message which is exfiltrated.
5. Payload instructs Operator to open news.ycombinator.com account settings, copy the private email, return to attacker page and paste it into the form.
6. Attacker receives the PII; same flow works on Booking.com (address, phone) and The Guardian.
**How found:** Observed Operator eagerly follows hyperlinks and that form submissions/Update clicks trigger confirmation dialogs, but plain typing rarely does; hypothesized a page that exfiltrates on keystroke would bypass the prompt-injection monitor.
**Exploitation:** Attacker needs only a place to host injected text (public GitHub issue) plus a keystroke-logging page. When a victim asks Operator to read the issue, the agent follows the link, then is instructed to visit authenticated sites, copy PII, and type it into the attacker page, which exfiltrates on input without any submit click, evading confirmation dialogs.
**Escalation:** Reused across multiple authenticated sites (Hacker News, Booking.com, The Guardian); typing avoids submit-button confirmations, and one early run set GitHub status without confirmation.
**Insight:** Agent confirmations cluster around clicks/submits; input events (typing) are a quieter exfil channel. Test whether an agent's guardrails gate actions vs. data entry, and host injected instructions where agents are routinely pointed (issue trackers, docs).