ChatGPT Flaw Could Let Attackers Steal Gmail Data Across User Accounts

Security researchers have revealed a recently patched flaw in ChatGPT’s isolation system that could have allowed attackers to access data from a victim’s connected Gmail account and send it to a separate ChatGPT account through a hidden cross-account channel.

Check Point Research, led by researcher Alexey Bukhteyev, discovered that attackers could embed instructions within a shared ChatGPT conversation, malicious prompts, or custom GPT configurations.

These instructions could cause a victim’s ChatGPT session to perform hidden tasks alongside the user’s legitimate requests. While the visible response would seem normal, data retrieved from connected applications could be sent to the attacker without being displayed in the chat output.

ChatGPT Flaw Steal Gmail Data

The issue stemmed from the architecture that supports ChatGPT’s code-execution capabilities. ChatGPT can create isolated containers for tasks such as analysis, file processing, and dependency installation.

Although these containers were designed to block direct internet access and communication between different users or accounts, researchers found they could access a shared internal JFrog Artifactory service.

Artifactory served as an internal package repository, allowing the containers to retrieve Python, npm, and other software dependencies without reaching public repositories.

However, researchers discovered that container credentials could also access Artifactory’s Item Management API endpoints, which included functions to set and read metadata properties associated with cached repository items.

This created a mechanism for cross-tenant data sharing. A container linked to one ChatGPT account could attach a property that contained text or Base64-encoded data to a shared cached file.

A container in another account could then query the same item and read this property. Larger payloads could be divided into multiple chunks and reassembled by the receiving environment.

Check Point described this outcome as a “shared clipboard” between containers that were supposed to remain isolated. The flaw did not require containers to communicate directly or access the public internet; instead, they used mutable metadata in a shared internal service to create a bidirectional covert channel.

Researchers demonstrated how this channel could be combined with prompt injection. An attacker could insert hidden instructions into a shared ChatGPT conversation or within a custom GPT’s configuration.

When a victim opened the conversation and submitted a normal request, ChatGPT could process the visible task while retrieving an attacker-supplied command through the covert channel.

In a proof of concept, a victim had connected Gmail to ChatGPT. During an otherwise unrelated request, ChatGPT accessed the connected mailbox, retrieved the requested email data, and sent it back to the attacker via the Artifactory-based channel.

The victim received a standard response and did not see any details of the hidden Gmail query in the visible output. The only potential indication was an “Talked to Gmail” activity label that appeared after the action, which did not provide an opportunity to approve or block the access in advance.

The flaw’s impact depended on the tools, applications, files, and permissions available to the victim’s ChatGPT session. Beyond Gmail, affected sessions could potentially expose accessible data from services such as Google Drive, Microsoft Teams, GitHub, or uploaded files and chat history.

According to Check Point, OpenAI was notified about the issue and confirmed that the internal Artifactory instance involved in the research had been decommissioned. By the time the report was published, the cross-account channel was no longer active.

This finding highlights a broader security concern around agentic AI: sandboxing code execution is insufficient if shared internal services maintain writable states that aren’t isolated by user, account, or session. Organizations should implement strict tenant separation, least-privilege access, and explicit approval controls for connected-app data access.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.