{"id":9373,"date":"2026-09-09T11:48:19","date_gmt":"2026-09-09T11:48:19","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9373"},"modified":"2026-09-09T11:48:19","modified_gmt":"2026-09-09T11:48:19","slug":"chatgpt-flaw-lets-attackers-pull-gmail-data-across-accounts-via-a-hidden-channel","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9373","title":{"rendered":"ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A flaw in OpenAI\u2019s ChatGPT allowed attackers to extract data from a victim\u2019s connected Gmail account by passing hidden instructions between separate user sessions, according to research from Check Point.<\/p>\n

In a proof-of-concept, Check Point demonstrated that a victim\u2019s ChatGPT session could retrieve email data and relay it to an attacker-controlled session within a single, seemingly normal interaction.<\/p>\n

\u201cCheck Point Research discovered a covert cross-account command channel through which an attacker could use a victim\u2019s ChatGPT session to execute hidden tasks with the tools, data, and connected apps available to that session,\u201d Check Point researcher Alexey Bukhteyev wrote<\/a> in the report. \u201cIn our proof of concept, ChatGPT retrieved email data from the victim\u2019s connected Gmail account and relayed it to the attacker.\u201d \u00a0<\/p>\n

OpenAI has since fixed the issue, according to the report, confirming that the internal service involved has been decommissioned.<\/p>\n

Check Point described this as a \u201ccoerced insider\u201d scenario, where the AI system itself is not compromised but can be manipulated into performing unintended actions within the organization\u2019s trust boundary.<\/p>\n

The attack\u2019s reach extended to anything the victim\u2019s session was already authorized to access, including Google Drive, Microsoft Teams and GitHub connectors, not just Gmail, the report added.<\/p>\n

A covert cross-account channel<\/h2>\n

The vulnerability stemmed from ChatGPT\u2019s code execution environment, where tasks run inside isolated containers tied to individual user accounts.<\/p>\n

To support software installation inside those containers, OpenAI routes package requests through an internal service based on JFrog Artifactory, according to the report.<\/p>\n

While containers are not supposed to communicate with each other, Check Point found that each container could write and read metadata in that shared service.<\/p>\n

\u201cThe package delivery metadata effectively became a shared clipboard between containers that were supposed to be walled off from one another,\u201d the report said.<\/p>\n

By writing instructions into that shared metadata, an attacker\u2019s session could pass tasks to a victim\u2019s session. \u201cA crafted instruction could make a victim\u2019s ChatGPT session quietly process a second stream of tasks alongside the conversation the victim could actually see,\u201d Check Point said in the report.<\/p>\n

Gmail data accessed without user awareness<\/h2>\n

In its demonstration, Check Point showed that the hidden task could instruct ChatGPT to retrieve data from a victim\u2019s connected Gmail account and return it to the attacker.<\/p>\n

\u201cThe visible answer looked completely ordinary,\u201d the report said, even as the hidden task executed in parallel.<\/p>\n

The scope of the attack depended on what the victim\u2019s session was authorized to access, including email, files, and other connected applications such as cloud storage or collaboration tools, according to Check Point.<\/p>\n

User awareness was minimal. The only indication observed was a small label \u2018Talked to Gmail\u2019 showing that an external service had been accessed, logged after the action had already taken place, the report said.<\/p>\n

Issue tied to the same infrastructure<\/h2>\n

Check Point Research said its proof of concept was already working before a separate chain of activity on the same Artifactory instance led into the Hugging Face compromise that OpenAI has since disclosed publicly. The two incidents used different techniques but trace back to the same shared internal service.<\/p>\n

Shilpi Handa, associate research director at IDC, said a repeat isolation failure on the same infrastructure changes how enterprises should weigh vendor risk.<\/p>\n

\u201cCan one tenant\u2019s container read or write data another tenant\u2019s container can also access?\u201d is a question CIOs should be putting directly to AI vendors, Handa said, since the answer isn\u2019t something customers can verify independently.<\/p>\n

Handa said enterprises should also ask vendors how many isolation-boundary findings they have logged over the past 12 months and what changed structurally after each one.<\/p>\n

OpenAI did not immediately respond to a request for comment.<\/p>\n

Controls that enterprises can apply now<\/h2>\n

Handa said enterprises don\u2019t need to wait on vendor answers to reduce exposure. She recommended authorizing connected apps narrowly rather than by default, granting a calendar connector without also enabling Gmail and Drive access.<\/p>\n

A limited grant \u201cnarrows what any container-level leak can expose,\u201d Handa said.<\/p>\n

She also recommended routing connected-app traffic through DLP or CASB inspection to catch regulated data before it leaves the pipeline, and requiring an API or webhook that logs every connected-app read and write, with timestamp and data category, exported to the enterprise\u2019s own SIEM.<\/p>\n

Without that logging, Handa said, \u201cyou can\u2019t detect this class of leak even post-patch.\u201d She said admin consoles at some vendors let customers override default risk-tiering on reads involving Gmail or Drive, forcing explicit approval rather than automatic access. That override is worth applying specifically to confidential or regulated data sources such as legal, HR, or finance systems, she said.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A flaw in OpenAI\u2019s ChatGPT allowed attackers to extract data from a victim\u2019s connected Gmail account by passing hidden instructions between separate user sessions, according to research from Check Point. In a proof-of-concept, Check Point demonstrated that a victim\u2019s ChatGPT session could retrieve email data and relay it to an attacker-controlled session within a single, […]<\/p>\n","protected":false},"author":0,"featured_media":9374,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9373","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9373"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9373"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9373\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9374"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9373"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}