Nigeria’s National Information Technology Development Agency (NITDA) has raised alarms over newly discovered vulnerabilities in OpenAI’s GPT-4.0 and GPT-5 models that could expose users to data leaks and manipulated outputs.
The agency, through its Computer Emergency Readiness and Response Team (CERRT.NG), reported seven critical weaknesses allowing attackers to embed hidden instructions in webpages, comments, or crafted URLs. These instructions can trigger unintended commands in ChatGPT during browsing, summarisation, or search tasks, sometimes without any direct user interaction. Some flaws also bypass safety filters using trusted domains, while others exploit markdown rendering weaknesses.
“Attackers could even poison ChatGPT’s memory, making injected instructions persist across future interactions,” NITDA said, warning that these vulnerabilities pose significant risks to individuals and enterprise systems alike. While OpenAI has partially addressed the issues, challenges remain in distinguishing legitimate user intent from malicious content.
NITDA advised users to limit or disable ChatGPT’s browsing and summarisation features on untrusted websites, enable memory or browsing functions only when necessary, and regularly update GPT models to patch known flaws.
In a separate advisory, NITDA also warned of new security threats affecting Cisco Secure Firewall ASA and Threat Defense systems. Cybercriminals are exploiting older vulnerabilities to forcibly reboot devices, causing network instability and potential service disruptions. The agency urged organisations to review configurations and ensure devices are fully updated to prevent forced restarts.
