Research explained
ZombieAgent research combined ChatGPT data exfiltration with persistent memory
Radware’s reported demonstration illustrates why recurring prompt-injection variants need system-level containment.
What happened
Ars Technica reported on Radware’s ZombieAgent research in January 2026. The demonstration described prompt injection that could send private information from the assistant’s server-side environment and plant instructions in long-term memory.
Server-side activity can leave fewer clues on a user’s endpoint than a conventional local compromise. The reporting describes a researcher-demonstrated path, not proof of widespread theft from ChatGPT users.
Review connector access and unexpected memory entries, and require approval for sensitive outbound actions. The source reviewed here does not establish current exploitability or a universal affected-version range; consult current product guidance before applying the historical finding to a deployment.
Next step
Review assistant memory, connected data access and outbound-action controls.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
ARS