ChatGPT flaw allows attackers to secretly steal Gmail data

Researchers have found a way to get ChatGPT to access a victim’s Gmail, chat history, and files by exploiting a hidden communication channel that connects separate user accounts.

Check Point Research discovered that ChatGPT sessions belonging to different users could secretly communicate with each other through an internal service. An attacker could use that channel to send a hidden instruction to a victim’s ChatGPT session, which would then carry out the task using the access already available to the victim.

The attack could reach data from connected services such as Gmail, Google Drive, Microsoft Teams, and GitHub, depending on what the victim had connected to ChatGPT. It could also access files and conversation history available to the affected session.

The researchers demonstrated the attack by making a victim’s ChatGPT session retrieve email data from Gmail and send it back to an attacker. The worrying part was that the victim did not see the attacker’s request.

The hidden task could arrive in several ways. An attacker could put the instruction into a malicious prompt, a shared ChatGPT conversation, or a custom GPT. Once the instruction reached the victim’s conversation, the victim only needed to send a normal message for ChatGPT to check for and execute the waiting task.

So, for instance, the victim could ask ChatGPT a completely ordinary question and receive the expected answer while the AI quietly handled a second task in the background.

“The visible answer looked completely ordinary,” Check Point said.

Sharing secrets

The researchers refer to the mechanism as a hidden “shared clipboard.”

ChatGPT runs some tasks inside isolated code-execution environments, or containers. Those containers could not communicate directly with each other, but they could all access the same internal package management service (a JFrog Artifactory instance) that delivers software packages.

The researchers found that the service allowed those containers to store and retrieve small pieces of data. More importantly, a container belonging to one account could write information that a container belonging to another account could later read.

The researchers turned that connection into a 2-way channel. An attacker could place a task in the shared storage, while the victim’s session could pick it up, execute it, and return the result through the same channel.

The potential impact depended on the permissions attached to the victim’s ChatGPT session. And the victim could do little to prevent it, as ChatGPT’s default connected-app settings automatically approved some read operations considered low risk.

For instance, in its Gmail demonstration, the only visible indication was a small “Talked to Gmail” label that appeared after the data had already been accessed.

A leaking faucet

The finding follows an earlier ChatGPT vulnerability investigated by Check Point in which attackers could use a malicious prompt to extract information from conversations and uploaded files and send it outside the platform.

That attack also relied on an unexpected communication path inside ChatGPT’s restricted environment. A malicious prompt could turn routine system requests into a covert channel for moving stolen information to an attacker-controlled server.

The new research shows a different risk. Rather than simply finding a way to move data out of ChatGPT, an attacker could use one ChatGPT account to quietly give instructions to another account.

That distinction matters as AI assistants gain access to email, cloud storage, workplace tools, and other sensitive systems. The more permissions a user gives an AI assistant, the more useful that assistant becomes to an attacker who can secretly control part of its behavior.

Check Point described the problem as turning an AI assistant into a “coerced insider.”

OpenAI has since decommissioned the specific internal Artifactory service involved in the research, closing this particular attack path.