ChatGPT's Memory Feature Supercharges Prompt Injection

Radware researchers demonstrated "ZombieAgent," a proof-of-concept that amplifies indirect prompt injection (IPI) attacks against ChatGPT by abusing connectors (e.g., email integrations) and the model's long-term memory to persist malicious instructions and exfiltrate data via encoded URL schemes; OpenAI later implemented mitigations restricting attacker-supplied domains and modified-URL usage, but Radware warns structural defenses (like source-trust and intent-awareness) are still needed to fully address such risks.