ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel
Check Point found a ChatGPT flaw letting attackers read victims' Gmail and connected-app data via hidden cross-session instructions; OpenAI patched it.
Check Point Research discovered a covert cross-account command channel in ChatGPT's code execution environment, where containers meant to be isolated shared metadata through an internal service based on JFrog Artifactory. In a proof of concept, a victim's session was tricked into retrieving Gmail email data and relaying it to an attacker-controlled session during an ordinary-looking interaction, with reach extending to any connected apps the session was authorized for, including Google Drive, Microsoft Teams, and GitHub. OpenAI fixed the issue and decommissioned the internal service; the same shared infrastructure was also involved in the separately disclosed Hugging Face compromise, though via different techniques.
- Containers shared metadata via an internal Artifactory service, creating a covert cross-account channel.
- Hidden tasks ran alongside visible chats; only trace was a post-hoc 'Talked to Gmail' label.
- Attack scope covered any connected apps the session could access, including Drive, Teams, and GitHub.
- OpenAI decommissioned the internal service, which was also tied to the Hugging Face compromise.
- Experts advise narrow app grants, DLP/CASB inspection, and SIEM logging of connected-app reads.
- Organizations
- Check Point ResearchOpenAIIDC
- AI models
- ChatGPT
From the original article
4 min read at csoonline.com
A flaw in OpenAI’s ChatGPT allowed attackers to extract data from a victim’s connected Gmail account by passing hidden instructions between separate user sessions, according to research from Check Point. In a proof-of-concept, Check Point demonstrated that a victim’s ChatGPT session could retrieve email data and relay it to an attacker-controlled session within a single, seemingly normal interaction.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.