ChatGPT Operator vulnerable to prompt injection leading to data leaks and unwanted actions
OpenAI · Feb 1, 2025 · General agent
What happened
Security researcher Johann Rehberger documented critical prompt-injection vulnerabilities in ChatGPT Operator, the browser-using agent, showing hidden instructions on web pages could hijack the agent's actions - enabling data exfiltration and unauthorized purchases. The work underlined that prompt injection against autonomous agents is effectively unsolvable with current defenses.
Causal vector
Indirect prompt injection on visited web pages hijacks the agent's tool calls
Source
Reported by Embrace The Red (Johann Rehberger). Verified against the primary report.
Defense-in-depth: prompt injection will keep happening, so every consequential tool call (purchase, data send, provision) must be independently authorized by the firewall, not trusted to the agent's own judgment.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
NeuralTrust: 34.9% of enterprises report confirmed AI agent security incidents
NeuralTrust · Jun 1, 2026
HUMAN Security: AI agent traffic grew 7,851%, 8x faster than human traffic
HUMAN Security · Jan 1, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 27 documented failures, one control.