AgentFlayer: How One Poisoned Google Drive Document Made ChatGPT Hand Over Your API Keys
Key takeaways
- →At Black Hat USA 2025, Zenity Labs researchers Michael Bargury and Tamir Ishay Sharbat showed that a document shared into a victim's Google Drive could hijack ChatGPT when it was connected through Connectors.
- →A hidden 300-word prompt in tiny white text told ChatGPT to search the victim's Drive for API keys and place them in the parameters of an image URL that loaded from an attacker server.
- →OpenAI added mitigations, but the pattern applies to every AI assistant with connectors. AgentGuard blocks instructions from shared content and stops secrets leaving through agent output.
- 1
Attacker shares a poisoned document to the victim
- 2
Victim asks ChatGPT to summarize it
- 3
Hidden prompt redirects the assistant
- 4
Assistant searches Drive for API keys
AgentGuard blocks the out-of-task secret search and the patterned image URL carrying the keys
- 5
Keys leak via image URL to attacker server
- Affected
- ChatGPT users with Google Drive Connectors (mitigated by OpenAI)
- When
- Presented at Black Hat USA, August 2025
- Impact
- Theft of API keys and secrets stored in connected cloud drives
What happened
ChatGPT Connectors let the assistant read a user's Google Drive, SharePoint, GitHub and other business systems. Zenity Labs found that the connection itself was the attack surface. All the attacker needed was the victim's email address to share a file with them.
The document contained a hidden prompt in one-pixel white text. When the victim asked ChatGPT to summarize the file, the prompt took over. It told the assistant that the summary wasn't needed, that it should search the connected Drive for API keys, and that it should output a Markdown image whose URL carried the keys as parameters.
To get past OpenAI's URL safety checks, the researchers hosted the image on Azure Blob Storage, a domain the platform trusted, and read the stolen keys from Azure Log Analytics. Zenity presented the attack as part of its AgentFlayer research at Black Hat USA 2025, where it showed similar zero-click chains against other enterprise agents.
Why nothing caught it
File sharing is normal. Summarizing a document is normal. Loading an image from Microsoft's own cloud storage is normal. Each step looked like business as usual, and the leak happened the moment the response rendered.
- The shared file contained no macros or malware
- The connector used a valid OAuth grant
- The exfiltration domain was a trusted Azure endpoint
- Secrets scanners look at repositories, not AI responses
How AgentGuard would have stopped it
AgentGuard knows which assistants have connector access to which corporate repositories, and it watches what those assistants do with that access. The user asked for a summary of one document. A sweep of the whole Drive for credentials is outside that task, and AgentGuard blocks it at step four.
If secrets did reach the response, AgentGuard's output controls catch credential patterns and encoded data inside URLs and stop the response from triggering the outbound request. The allow-listed domain doesn't matter. What matters is that a secret is about to leave in an agent's output.
What to do Monday
Connectors turn every shared file into a possible command.
- Inventory AI connectors and the repositories they can read
- Move secrets out of documents and into a vault
- Treat externally shared files as untrusted AI input
- Block secrets and encoded data in agent-generated URLs
The lesson
None of these attacks needed malware, stolen passwords or a phishing click. An AI agent with legitimate access read attacker-controlled content and acted on it. Vendor patches close one path at a time. AgentGuard closes the class: every agent action is judged against the agent's task, its Principal and where its instructions came from, with zero integration and deployment measured in days.
Frequently asked questions
What is AgentFlayer?
AgentFlayer is Zenity Labs' research into zero-click attacks on enterprise AI agents, presented at Black Hat USA 2025. One demonstration used a poisoned Google Drive document to make ChatGPT Connectors leak API keys.
How did AgentFlayer bypass ChatGPT's link safety checks?
The researchers loaded the exfiltration image from Azure Blob Storage, a domain ChatGPT trusted, and collected the stolen data from the storage logs.
How does AgentGuard stop connector poisoning?
AgentGuard refuses instructions that come from shared content, blocks agent searches that fall outside the user's task, and stops secrets or encoded data leaving in agent output.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.