The National Information Technology Development Agency (NITDA) has issued a fresh advisory warning Nigerians about newly discovered vulnerabilities in ChatGPT that could expose users to data leakage and manipulation attacks.
According to the agency, researchers identified seven vulnerabilities affecting GPT-4o and GPT-5 models, enabling attackers to exploit ChatGPT through indirect prompt injection.,
In the advisory released on Monday, December 8, 2025, NITDA explained that malicious actors can embed hidden instructions inside webpages, comments, or URLs, which ChatGPT may unknowingly execute during regular browsing or summarisation tasks.
“By embedding hidden instructions in webpages, comments, or crafted URLs, attackers can cause ChatGPT to execute unintended commands simply through normal browsing, summarisation, or search actions,” the agency stated.
The warning comes amid rising concerns over AI tools interacting with unsafe online content, as well as the increasing reliance on ChatGPT for business, research, and government operations.
The agency said some of the vulnerabilities allow attackers to bypass safety systems by masking harmful commands behind legitimate-looking domains.
It added that other weaknesses exploit markdown-rendering bugs, making malicious instructions invisible to users but readable by the AI model.
In severe cases, attackers can poison ChatGPT’s memory, forcing the system to retain harmful instructions that may influence future conversations.
While OpenAI has reportedly addressed parts of the issue, NITDA said LLMs still struggle to reliably distinguish between genuine user input and malicious prompts.
According to the advisory, the vulnerabilities could result in several cybersecurity threats, including:
- Unauthorised actions carried out by the model
- Unintended exposure of user information
- Manipulated or misleading outputs
- Long-term behavioural changes from memory poisoning
CERRT.NG further warned that users may unknowingly trigger attacks without clicking or interacting with anything, especially when ChatGPT processes webpages or search results containing hidden malicious commands.
To mitigate risks, the agency advised Nigerians, businesses, and government institutions to adopt stricter safety practices, including:
- Limiting or disabling browsing and summarisation of untrusted websites in enterprise environments
- Enabling features like browsing or memory only when necessary
- Ensuring regular updates and patches for GPT-4o and GPT-5 deployments
The agency stressed that proactive cybersecurity measures are essential as AI tools become more deeply integrated into public and private-sector operations.
© 2025 Naijaonpoint, a division of NOP Media Inc. Contact us via [email protected]