ChatGPT flaw exposed a hidden cross-account channel that could access users’ Gmail

Security researchers found a flaw in ChatGPT that created a covert communication channel between otherwise isolated user sessions, potentially allowing attackers to reach services connected to a victim’s account, including Gmail.

When ChatGPT needs to execute code, it runs that work inside isolated containers. Those containers are not supposed to have direct internet access, so OpenAI used an internal JFrog Artifactory service to handle package delivery. Sessions from different accounts could not talk to each other directly, but they all had access to that same internal service.

Check Point researchers found that Artifactory exposed a subtle weakness. Containers could attach text or binary metadata to repository objects and later read it back using credentials that were already available inside the environment. The team confirmed that one user’s container could write data that another user’s container could retrieve moments later, effectively turning Artifactory metadata into a shared message board between sessions that were meant to be isolated.

That channel could then be used to pass instructions from an attacker’s session to a victim’s. The researchers say a single injected instruction could make ChatGPT check the shared storage during the victim’s next interaction. The payload could be delivered through a malicious prompt, a shared-chat link or a custom GPT whose hidden instructions were not visible to the user. Once triggered, the victim’s session could carry out the task with whatever permissions it already had and send the result back through the same channel without disrupting the user’s normal conversation.

The potential reach depended on what the victim had already connected to ChatGPT. That could include chat history, uploaded files and external services such as Gmail, Google Drive, Microsoft Teams or GitHub. In Check Point’s proof of concept, ChatGPT accessed a victim’s email during an otherwise ordinary interaction and passed the contents back to the attacker.

There was also little to alert the user. ChatGPT can automatically approve certain read-only actions it considers low risk, so no separate confirmation was necessarily required. In the Gmail demonstration, the main visible clue was a small “Talked to Gmail” label that appeared only after the access had already taken place.

The issue has since been fixed. Check Point reported the vulnerability to OpenAI, which confirmed that the internal Artifactory instance involved in the attack had been retired.

Check Point describes the technique as a “coerced insider” attack. The model itself is not compromised and does not act maliciously on its own. The risk comes from placing it inside a trusted environment with access to a user’s credentials, then feeding it instructions from content it should not have treated as trusted.