ChatGPT Flaw Allowed Attackers to Steal Gmail Data Across User Accounts

A newly disclosed, now-remediated ChatGPT isolation flaw could have enabled attackers to access Gmail data, chat history, uploaded files, and other connected-app content from a victim’s session, then secretly relay it to a separate attacker-controlled account.

Check Point Research, led by researcher Alexey Bukhteyev, found that isolated ChatGPT code-execution containers could communicate indirectly through an internal software-package service.

The issue effectively created a covert cross-account command channel, allowing a malicious instruction to turn a victim’s ChatGPT session into a hidden data-collection agent.

ChatGPT Flaw Allowed Attackers

ChatGPT uses sandboxed containers for code execution and analysis tasks. These environments were designed without public internet access and were intended to prevent direct communication between separate users, conversations, and accounts.

However, the containers could access an internal JFrog Artifactory instance used to retrieve Python, npm, and other software dependencies.

According to Check Point, the service exposed Artifactory Item Management API operations that let container credentials attach and retrieve metadata properties associated with cached repository files.

Alexey Bukhteyev found that a property written to an item by a container belonging to one ChatGPT account could be read by a container under a different account. This meant attackers could use mutable item properties as a shared clipboard.

The channel supported text directly and binary data encoded in Base64. Larger content could be split into chunks, assigned to multiple property keys, and reassembled by the recipient container.

Although the containers couldn’t communicate directly, the shared internal service became an unintended bidirectional communication layer.

Check Point demonstrated that attackers could embed a short malicious instruction in a shared ChatGPT conversation, a pasted prompt, or a custom GPT’s hidden configuration.

Once present in a victim’s conversation context, the instruction could prompt ChatGPT to process a second, concealed stream of attacker-supplied tasks alongside the user’s visible request.

In the proof of concept, a victim opened a shared conversation and submitted an ordinary message. ChatGPT returned a normal response to the visible query while simultaneously checking the covert channel for an attacker task.

The hidden task instructed ChatGPT to access the victim’s connected Gmail account, retrieve email information, and send the results back through the cross-account channel. The visible response did not expose the parallel task or the extracted data.

The only potential indicator was a “Talked to Gmail” label shown above the response after the read operation had already occurred.

The researchers warned that the impact extended beyond Gmail. A compromised session could potentially access whatever connected tools, files, chat context, and external services were already authorized for that user, including Google Drive, Microsoft Teams, and GitHub.

Under ChatGPT’s default connected-app permissions, lower-risk read actions may occur without a separate approval prompt.

While that model reduces friction for legitimate use, it can raise the impact of prompt-injection scenarios where an attacker persuades the AI to perform authorized actions for an unauthorized party.

The incident highlights a critical agentic-AI security lesson: network sandboxing alone is insufficient. Internal APIs, runtime credentials, shared metadata, package infrastructure, and connected applications must all enforce strict tenant isolation and least-privilege access.

Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC

The post ChatGPT Flaw Allowed Attackers to Steal Gmail Data Across User Accounts appeared first on Cyber Security News.