Confused ChatGPT: cross-app context poisoning via the first-party API
Confused ChatGPT: Cross-App Context Poisoning via First-Party APIs
Quick read
Based on the paper's full text (AI-generated); refer to the original
Researchers proposed cross-app context poisoning in ChatGPT Apps, a variant of indirect prompt injection in which a malicious app can write persistent instructions into the shared chat context via the first-party API sendFollowUpMessage. The API's runtime also accepts undocumented parameters systemPrompt and isVisible:false, which can elevate the injection to system priority and keep it from appearing in the chat interface. Based on this, the researchers implemented a confused deputy attack, validating it with conditional and imperative payloads on six ChatGPT models (GPT o3 Reasoning, GPT 5.2 Instance, GPT 5.2 Thinking, GPT 5.3 Instance, GPT 5.4 Thinking, GPT 5.5 Thinking), for example changing the search city of a benign hotel booking app from Tokyo to Osaka.
- ChatGPT Apps lets multiple third-party apps share the same chat context, and the ecosystem grew from 122 apps to 888, but its security isolation has never been studied. The authors aim to answer: when multiple apps coexist and interact through LLM mediation, how are they isolated from one another?
- The authors crawled and statically analyzed app stores and client bundles, enumerated the window.openai API, and found that sendFollowUpMessage can write to the shared context and at runtime silently accepts the undocumented systemPrompt and isVisible:false parameters, which can elevate an injection to system priority and hide it from the UI. Based on this, they construct a confused-deputy attack, containing both conditional and imperative payloads.
- On six current ChatGPT models, both payloads succeeded: the conditional one lets a malicious app contaminate the context so that when the user later invokes a benign hotel app, they are redirected to the wrong city; the imperative one makes the LLM directly invoke the victim app's tools without a user request. They also confirm that requestTargetedReply and MCP tool descriptions are also contamination channels, and some channels are blocked by alignment.
- The framework is closed-source and evolving rapidly; the conclusions are as of May 2026, only client-side code was analyzed, and the server side may have unobserved protections; the attacks were verified with apps built by the authors, and a real attacker would still need to pass app store review. The authors consider the root cause to be the architecture's lack of context isolation, which cannot be completely eliminated even with an ideal isolation model because natural language data cannot be deterministically validated; directions such as cross-session memory contamination are left for future work.
The paper discloses that the shared context of ChatGPT Apps lacks isolation, and a malicious app can use sendFollowUpMessage to inject persistent instructions that affect other apps in the same session.