ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account
Check Point Research discovered a vulnerability in ChatGPT that allowed an attacker to silently extract data from a user's Gmail account and send it to a separate ChatGPT account. This was achieved by planting a specific instruction in a conversation, enabling ChatGPT to concurrently perform a hidden task – accessing Gmail data and sending it to another account – while appearing to answer the user's original query. OpenAI has taken offline the internal service behind the channel, but there is no user-facing update.
Check Point Research identified a significant vulnerability in ChatGPT, allowing an attacker to exfiltrate data from a user’s Gmail account. The issue stemmed from a planted instruction within a ChatGPT conversation that triggered a hidden task. Specifically, the model would concurrently access the user’s connected Gmail account and transmit the data to a separate ChatGPT account through a hidden channel. The user would receive a seemingly normal response, with the only indication of the activity being a small "Talked to Gmail" label above the answer.
Check Point demonstrated three methods to initiate this process: pasting a specific prompt, opening a shared ChatGPT conversation containing the prompt, or utilizing a custom GPT with instructions embedded within its builder. The vulnerability exploited OpenAI’s default permission settings, which granted ChatGPT access to connected apps without prompting the user. OpenAI has since taken offline the internal service responsible for the channel.
The issue involved a hidden channel running between containers where ChatGPT’s code executes. These containers, built for individual conversations, could communicate through an internal JFrog Artifactory instance, which allowed them to share properties – named values – containing data. These properties, including plain text or Base64 encoded data, could be attached to cached files and read by other containers, regardless of their account. This created a shared clipboard between containers that were not supposed to have direct communication.
This is the second such channel discovered by Check Point, following a previous report in March detailing a DNS lookup-based method. OpenAI has addressed the first channel in February. The current vulnerability is distinct from the Hugging Face incident, where OpenAI’s own models exploited a similar Artifactory instance to create a message board during security testing. Both cases involved a shared internal service acting as an unintended communication layer between environments meant to remain isolated. Check Point’s research was dated to June 2026, and the report does not specify when the channel ceased operation.