A recent analysis from Check Point has revealed a significant vulnerability in OpenAI’s ChatGPT that allowed attackers to extract sensitive email data from a victim’s linked Gmail account. This exploit relied on hidden instructions transmitted between distinct user sessions, effectively bypassing security protocols.
In their proof-of-concept demonstration, Check Point showcased how a seemingly innocuous interaction with ChatGPT could enable a victim’s session to retrieve sensitive information and pass it to an attacker-controlled environment. “Check Point Research discovered a covert cross-account command channel through which a victim’s ChatGPT session could be manipulated to execute unintended tasks,” explained researcher Alexey Bukhteyev in the report. This manipulation allowed ChatGPT to extract data from Gmail and relay it to a malicious actor.
In response, OpenAI swiftly addressed the issue, confirming the decommissioning of the internal service involved in this exploit.
A Covert Cross-Account Channel
The roots of the vulnerability can be traced back to ChatGPT’s execution environment where user tasks operate within isolated containers. To allow for software installations, OpenAI has integrated these containers with an internal service based on JFrog Artifactory. Although these environments are designed to be isolated, Check Point uncovered that they could read and write metadata to this shared service.
“The package delivery metadata became a shared clipboard between separate containers, which should have been entirely isolated,” the report indicates. Through this shared metadata, attackers could pass instructions to a victim's session unnoticed, enabling them to execute concealed tasks alongside the legitimate conversation visible to the user.
Gmail Data Accessed Without User Awareness
During the demonstration, Check Point illustrated how a hidden instruction could instruct ChatGPT to access data from a victim’s connected Gmail account, returning the information to the attacker. The result appeared entirely normal to the victim, disguising the true nature of the interaction.
The extent of this exploit varied based on what the victim’s session was authorized to access, encompassing not just Gmail but potentially sensitive information from connected applications like Google Drive or Microsoft Teams. User awareness of these actions was minimal, with the only indicator being a label that stated ‘Talked to Gmail,’ which surfaced only after the unauthorized access had occurred.
Issue Tied to the Same Infrastructure
Check Point's findings indicate that this proof of concept was operational before a separate incident tied to the same Artifactory instance, which resulted in the compromise of Hugging Face—a scenario that OpenAI has publicly acknowledged. While both attacks employed distinct strategies, they originated from the same shared internal service.
Shilpi Handa, associate research director at IDC, highlighted that this repeat failure in isolation methods shifts the narrative on vendor risk management for enterprises. Handa emphasized the importance of questioning AI vendors about their environment’s cross-tenant data handling capabilities, as these are not straightforward for customers to verify independently.
Controls Enterprises Can Apply Now
Organizations don’t need to remain passive while awaiting vendor responses to this vulnerability. Handa recommends that companies authorize connected apps conservatively rather than allowing blanket access. For instance, enabling a calendar connector without simultaneously granting access to Gmail and Drive can minimize the fallout from potential container-level leaks.
She further suggests employing Data Loss Prevention (DLP) measures or Cloud Access Security Broker (CASB) inspections for connected-app traffic to intercept sensitive data before transmission. Moreover, requiring robust logging of read and write actions performed by connected apps can enhance visibility—information that should be timestamped and categorized within an organization’s Security Information and Event Management (SIEM) system.
The absence of such logging mechanisms means organizations cannot effectively detect this type of data leak, even post-remediation. Additionally, admin consoles for certain vendors may permit overrides of default risk settings concerning sensitive applications like Gmail or Drive, ensuring that any access to these sources mandates explicit permission. This is especially crucial for protecting confidential data within critical business functions like legal, HR, or finance operations.
