The National Information Technology Development Agency (NITDA) has warned Nigerians about newly discovered cybersecurity vulnerabilities in OpenAI’s GPT-4.0 and GPT-5 series models that could expose users to serious data-leakage and manipulation risks.
The advisory was issued on Monday in Abuja by the agency’s Director of Corporate Affairs and External Relations, Mrs Hadiza Umar, and released through NITDA’s Computer Emergency Readiness and Response Team (CERRT.NG).
Umar said seven critical vulnerabilities were identified in the models, which allow attackers to manipulate ChatGPT through indirect prompt injections hidden in seemingly harmless online content.
She explained that by embedding malicious instructions in webpages, online comments or crafted URLs, attackers could cause ChatGPT to execute unintended commands during routine browsing, summarisation or search activities.
“Some of the flaws also enable attackers to bypass safety filters by abusing trusted domains or exploiting markdown rendering bugs to conceal harmful inputs,” Umar said.
According to her, one of the most concerning risks is the potential for long-term manipulation, as attackers could poison ChatGPT’s memory, allowing injected instructions to persist across future interactions.
Umar noted that although OpenAI had implemented partial fixes, large language models still face fundamental challenges in distinguishing legitimate user intent from maliciously embedded data.
She said the vulnerabilities could result in unauthorised actions, information leakage, manipulated outputs and long-term behavioural influence, adding that users could be affected even without directly clicking on malicious content.
“The attacks can be triggered simply when ChatGPT processes search results or webpages containing concealed payloads,” she said.
To mitigate the risks, Umar urged organisations and users to limit or disable ChatGPT’s browsing and summarisation features for untrusted websites, and to only enable capabilities such as browsing or memory when operationally necessary.
She also called for regular updates and patching of GPT-4.0 and GPT-5 models to ensure known vulnerabilities are addressed.
Meanwhile, NITDA, through CERRT.NG, also issued an urgent warning over new security threats affecting Cisco firewall devices used by businesses, banks, government institutions and internet service providers.
The agency said cybercriminals were exploiting a new attack method targeting Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) systems, which could force devices to reboot unexpectedly and cause network outages.
According to the advisory shared on NITDA’s official X handle, the attackers are leveraging older vulnerabilities in a new way to trigger sudden restarts, leading to service disruptions and denial-of-service across affected networks.
