This week in other security issues in LLMs:

2025-09-22 · Bits and Bobs 9/22/25

This week in other security issues in LLMs:
- RadWare: ShadowLeak: A Zero-Click, Service-Side Attack Exfiltrating Sensitive Data Using ChatGPT's Deep Research Agent..
  - Ars Technica's summary
- Eito Miyamura: "We got ChatGPT to leak your private email data…
  - …All you need? The victim's email address"
  - Note, this is distinct from ShadowLeak.
  - It still boggles my mind that MCP is rolled out so broadly in ChatGPT.
- Bruce Schneier: Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents.

More on this topic

From other episodes