ChatGPT Cross-Account Hidden Channel Disclosed: Planted Instructions Silently Exfiltrate User Gmail
Check Point disclosed a ChatGPT hidden-channel flaw: instructions planted in a conversation make the model answer normally while silently reading the user's Gmail and sending it to another account. OpenAI took the involved internal service offline; no client update required.
Check Point Research published on September 8 a report disclosing a ChatGPT cross-account hidden channel: a single instruction planted in a conversation can make ChatGPT, while answering the user normally, silently read data from the connected Gmail account and send it to another ChatGPT account. OpenAI confirmed it took the internal service the exploit depended on offline; users do not need to install any update.
Incident Overview
Trigger conditions are extremely low. The attacker only needs one of three paths to plant malicious instructions in the victim session: induce the user to paste a malicious prompt, have the user open a shared conversation containing instructions, or hide code in a custom GPT's builder instructions (invisible to the user). After that, any ordinary message from the victim activates the attack.
Technical Details
The core is isolation failure in ChatGPT's code-execution containers. Containers of different accounts must not access each other, but all can connect to OpenAI's internal JFrog Artifactory package service (used instead of containers hitting public package registries directly). Check Point found the service lets containers attach and read named attributes on cached files; read credentials sit in container environment variables; metadata is not isolated per account. Verification: attributes written by one account's container are immediately readable by another's—package-service metadata became a cross-account shared clipboard.
In Thinking mode, the planted instruction makes the model run two workflows in the same turn: one answers the user normally; the other checks a hidden mailbox for attacker tasks, uses the victim session's existing tool permissions (e.g. read Gmail), returns results over the hidden channel, and supports Base64 chunk reassembly. The only user-visible trace is a small Talked to Gmail label above the answer—it records a read that already happened; the user never gets allow/deny. Note this is Check Point's second exfil channel on the same component: in March they disclosed a variant that exfiltrated conversation data via DNS queries.
Impact Assessment
Reach depends entirely on the victim session's existing permissions: conversation history, uploaded files, and data from connected apps such as Gmail, Google Drive, GitHub. Check Point notes this internal Artifactory instance is linked to the later public Hugging Face intrusion—both are isolation failures where a shared internal service became a cross-environment comms layer. Any AI assistant with credentials, tool access, and connected apps can be turned into a coerced insider executing attacker instructions.
Fix and Mitigation
- OpenAI took the involved internal Artifactory instance offline; the channel is dead; users need no client update.
- Individual users can switch connected-app permissions to Always ask so every read requires human approval.
- Enterprise admins should audit which apps are allowed in the workspace; Enterprise and Edu versions have app connections off by default—keep that.
- Treat high-efficiency prompts from unknown sources, shared conversation links, and custom GPTs with caution.
- Security teams should add AI session review to IR playbooks: which apps were authorized to which sessions.
References
- The Hacker News – ChatGPT Flaw Let a Planted Prompt Send a Victims Gmail Data to Another Account
- Check Point Research – ChatGPT Let Attackers Read Victims Gmail Through a Hidden Channel