ChatGPT Flaw Could Let Attackers Steal Gmail Data Across User Accounts
Check Point found a patched ChatGPT flaw where prompt injection and a shared Artifactory service let attackers covertly exfiltrate Gmail data across accounts.
Check Point Research discovered that ChatGPT's isolated code-execution containers could access a shared internal JFrog Artifactory service, whose item metadata API enabled a bidirectional cross-tenant covert channel between accounts. Attackers could embed hidden prompt-injection instructions in shared conversations or custom GPT configurations, causing a victim's session to silently relay connected Gmail data to another ChatGPT account. In a proof of concept, email data was exfiltrated with the only visible hint being a 'Talked to Gmail' activity label. OpenAI decommissioned the internal Artifactory instance involved, eliminating the channel by publication time.
- ChatGPT sandbox containers reached a shared internal JFrog Artifactory whose metadata API enabled cross-account sharing.
- Hidden instructions in shared chats or custom GPTs triggered silent actions via prompt injection.
- Proof of concept exfiltrated connected Gmail data; only hint was a 'Talked to Gmail' label.
- Connected services like Google Drive, Microsoft Teams, and GitHub were also potentially exposed.
- OpenAI decommissioned the internal Artifactory instance, closing the covert channel.
- Vendors
- OpenAICheck PointJFrog
- Products
- ChatGPTGmailJFrog Artifactory
- Organizations
- Check Point Research
- AI models
- ChatGPT
From the original article
3 min read at gbhackers.com
Security researchers have revealed a recently patched flaw in ChatGPT’s isolation system that could have allowed attackers to access data from a victim’s connected Gmail account and send it to a separate ChatGPT account through a hidden cross-account channel. Check Point Research, led by researcher Alexey Bukhteyev, discovered that attackers could embed instructions within a […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.