Radware’s September 2025 disclosure of ShadowLeak has shaken the cybersecurity community. While indirect prompt injection (IPI) attacks have been discussed before, ShadowLeak is unique: it executes from OpenAI’s cloud infrastructure, not the client side, and it requires no user interaction. This makes it stealthier than anything seen previously.
Here’s how it works. An attacker sends a legitimate-looking corporate email with hidden instructions text in white-on-white font, tiny fonts, or metadata invisible to human eyes. When a user asks ChatGPT to summarise emails, the agent consumes the malicious content. It then calls an attacker-controlled URL, appending sensitive details names, addresses, tokens, even legal strategies as query parameters. Crucially, the HTTP request originates from OpenAI’s servers, bypassing enterprise gateways, egress filters, and endpoint monitoring. The organisation never sees the data leave.
Testing showed the attack succeeded about half the time with simple prompts. With slight adjustments such as adding urgency or disguising the malicious endpoint as a compliance check success rates rose dramatically. ShadowLeak demonstrates that adversaries can socially engineer machines, not just humans.
For defenders, this introduces a new threat surface. Enterprise AI agents are increasingly wired into CRMs, HR systems, finance workflows, and SaaS applications. Protocols like Model Context Protocol (MCP) and Agent-to-Agent (A2A) create webs of autonomous activity. ShadowLeak illustrates how a single poisoned input can cascade across systems, creating chained compromises invisible to traditional detection.
Recommendations from Radware are clear:
- Sanitise inputs: strip hidden instructions before LLM ingestion.
- Instrument agents: log every action with metadata on “who, what, why.”
- Segment permissions: separate “read” vs “act” scopes, applying the principle of least privilege.
- Red-team with zero-click IPI scenarios before rolling out autonomous agents.
Defenders must also rethink detection. Classic regex or state-machine filters cannot catch natural-language exploits. Only semantic analysis—possibly by LLMs themselves, can flag intent. Security vendors will need to evolve rapidly.
ShadowLeak is not just another exploit; it is an early glimpse into the risks of the Internet of Agents. As enterprises embrace autonomy, predictability, auditability, and control will erode unless security evolves in lockstep. Treating AI prompts as untrusted input, hardening agent actions, and building semantic detection pipelines will be essential.
