AgentFlayer exploit chains showed zero-click data theft from ChatGPT, Copilot Studio, and Cursor via connected tools

OpenAI (ChatGPT), Microsoft (Copilot Studio), Cursor/Atlassian (Jira MCP)·ChatGPT Connectors, Microsoft Copilot Studio agents, Cursor with Jira MCPFixed

Zenity researchers built exploit chains dubbed AgentFlayer: a rigged document uploaded to ChatGPT hid a prompt instructing it to search the user's connected Google Drive for API keys and leak them via an Azure Blob image URL logged on the attacker's server; a crafted customer email hijacked a Copilot Studio support agent into emailing internal tool/CRM data to the attacker; and a poisoned Jira ticket synced from Zendesk let attackers extract repository secrets from Cursor via its Jira MCP integration.

Blast radius

Demonstrated exfiltration of API keys, CRM customer data, active chat conversations, and repository secrets across ChatGPT, Copilot Studio, and Cursor with no user clicks beyond a normal 'summarize this' request.

Root cause

Agents connected to third-party data sources (Drive, email, Jira/Zendesk) treated retrieved content as trustworthy instructions and used markdown/image rendering as an unmonitored exfiltration channel.

How it was caught

Found by Zenity researchers and disclosed responsibly to OpenAI and Microsoft ahead of the Black Hat USA 2025 presentation.

What changed

OpenAI patched the ChatGPT Connectors exfiltration bypass; Microsoft deployed a fix blocking the specific Copilot Studio prompts, though researchers noted prompt injection generally remains unsolved.

Take-awayAny agent with both external-content ingestion and an outbound rendering channel (images, links) is a data-exfiltration risk — audit what URLs/markdown an agent is allowed to render.