ChatGPT Apps 的安全漏洞暴露了多租户架构中共享上下文的致命缺陷，做 AI 应用安全或平台开发的团队值得关注——这提醒我们，隔离不是可选项，而是第三方生态的入场券。
OpenAI 于 2025 年 10 月推出的 ChatGPT Apps 引入了应用内应用范式，第三方应用与用户共享同一聊天上下文。研究人员发现一种名为“跨应用上下文投毒”的间接提示注入变种，恶意应用可通过 first-party API（如 sendFollowUpMessage）向共享上下文中写入内容，影响用户后续调用的其他良性应用。该漏洞利用了两个未公开参数 systemPrompt 和 isVisible，可实现静默、系统优先级的写入。根本原因在于架构设计：LLM 的上下文是持久、扁平、无标签的共享数据存储，缺乏隔离机制。研究人员已向 OpenAI 披露，但截至论文发表时，未公开参数仍可访问，架构缺陷属于设计使然。
Confused ChatGPT: Cross-App Context Poisoning via First-Party APIs
ChatGPT Apps, launched by OpenAI on Oct. 6, 2025, introduce an app-in-app paradigm in which third-party applications share a single chat context with the user and with every other connected app. The ecosystem grew from 122 apps in Dec. 2025 to 888 by May 2026, yet its security has remained uninvestigated. We identify cross-app context poisoning, a variant of indirect prompt injection distinguished by three properties: 1) the injection persists in the shared chat context across turns; 2) the effect surfaces through a different co-resident app the user later invokes; and 3) the delivery vectors are first-party APIs exposed to every connected app. We find multiple APIs capable of writing app-controlled content into the shared context, with sendFollowUpMessage as the most direct and potent channel. Two undocumented parameters that the runtime silently accepts, systemPrompt and isVisible, amplify this channel to silent, system-priority writes. Leveraging this channel, we realize a confused-deputy attack in which a malicious app poisons the context so that the LLM, consulting that context, enables manipulation against benign co-resident apps. We demonstrate two payload styles (conditional and imperative) and evaluate them across six current ChatGPT models. The root cause is architectural: the LLM's context is a persistent, flat, untagged data store shared by user and apps, with no isolation. Every mature multi-tenant platform, from Multics virtual memory to Android UIDs and iOS sandbox profiles, paid the isolation cost before admitting third parties; ChatGPT Apps did not. Fixing this requires an architectural change, not a patch. We disclosed our findings to OpenAI; the undocumented parameters remain accessible at the time of writing, and the architectural gap is by design: the shared context that enables cross-app composition is the same flat namespace that enables cross-app poisoning.