ChatGPT Flaw Could Secretly Exfiltrate Gmail Data Through a Planted Prompt

Published: September 9, 2026
Category: Artificial Intelligence / Vulnerability / Data Security
Threat Level: High

Executive Summary

Security researchers have demonstrated a ChatGPT attack technique in which a malicious instruction planted inside a conversation could silently turn the AI assistant into a data-exfiltration tool.

In a proof-of-concept developed by Check Point Research, the hidden instruction caused ChatGPT to access information from a victim's connected Gmail account and transfer the collected data to another ChatGPT account through an internal communication channel. At the same time, ChatGPT continued responding normally to the victim, potentially concealing the malicious activity.

The technique could potentially expose more than email. Researchers said the same mechanism could be used to access conversation history and files available to the affected ChatGPT session, depending on the user's connected applications, permissions and available tools.

OpenAI reportedly disabled the internal service used for the demonstrated cross-account communication channel. Because the issue was addressed on the service side, users do not have a traditional software patch to install.

Key Takeaways

• A malicious instruction planted inside a ChatGPT conversation could trigger hidden actions.
• The proof of concept demonstrated unauthorized access to data from a connected Gmail account.
• Stolen information could be transferred to another ChatGPT account through an internal communication channel.
• The visible ChatGPT response could remain unrelated to the malicious activity.
• Chat history and files available to the session could also potentially be targeted.
• Attackers could plant the instruction through malicious prompts, shared conversations or custom GPT instructions.
• The attack depended on the permissions and connected services already available to the victim's ChatGPT session.
• OpenAI took the internal service used in the proof of concept offline.
• The incident highlights the security risks created when AI agents can access sensitive enterprise applications.

How the Attack Worked

The attack began with prompt injection.

An attacker first needed to place a malicious instruction somewhere that would become part of the victim's ChatGPT context. Check Point identified several possible delivery methods:

1. Malicious prompt – A victim could paste attacker-controlled instructions into a conversation.
2. Shared conversation – A user could open a conversation containing a previously planted instruction.
3. Custom GPT – Malicious instructions could be embedded within the configuration or builder instructions of a custom GPT, where ordinary users may not immediately see them.

Once the malicious instruction was present, the victim only needed to send an otherwise normal message to trigger the workflow demonstrated by researchers.

The proof of concept was designed around ChatGPT's Thinking mode and instructed the system to perform two separate streams of work.

The first stream handled the user's legitimate request.

The second stream operated in the background, checking for instructions from the attacker, accessing information through the tools available to the victim's session and transferring the collected information.

The malicious instruction was designed to keep these activities separate so that the visible response appeared normal.

This creates a particularly dangerous scenario for AI security: the assistant can simultaneously perform a legitimate task for the user and an attacker-controlled task that the user never requested.

Gmail Data Could Be Used as the Initial Target

The researchers demonstrated the technique using a ChatGPT session connected to Gmail.

The hidden workflow instructed ChatGPT to retrieve information from the connected mailbox and transmit the results to another ChatGPT account controlled by the attacker.

Importantly, the attacker did not need to directly compromise the victim's Google account. Instead, the attack attempted to abuse the access that ChatGPT already possessed through the user's connected application.

The same principle could apply to other information available to an AI session, including:

• Email messages
• Conversation history
• Uploaded files
• Connected application data
• Information returned by enabled tools
• Other data accessible under the user's existing permissions

The exact amount of information exposed would therefore depend heavily on what applications and permissions were available to the targeted ChatGPT account.

The Hidden Cross-Account Communication Channel

One of the most significant technical aspects of the research involved the mechanism used to move information between ChatGPT environments.

ChatGPT can create isolated code-execution containers for certain conversations. These environments are designed to prevent direct communication between separate sessions.

However, Check Point researchers discovered that the isolated containers could communicate with a shared internal service used for package management.

The service was an internal JFrog Artifactory instance.

ChatGPT's code-execution environments could communicate with this service when packages needed to be installed. Researchers discovered that files stored by the service could have metadata properties attached to them and that those properties could subsequently be read from another environment.

The important security issue was that these properties were not sufficiently isolated between accounts.

Researchers demonstrated the problem by writing a test value into metadata from one ChatGPT environment and subsequently retrieving that value from a separate account.

This effectively transformed the shared service into a cross-account data-transfer mechanism between environments that were otherwise expected to remain isolated.

Turning Metadata Into a Covert Data Channel

The technique was not limited to a simple test string.

According to the research, metadata properties could contain text or Base64-encoded information. Larger data could also be divided into multiple properties and reconstructed by the receiving environment.

This created what researchers effectively demonstrated as a hidden "shared clipboard" between isolated ChatGPT containers.

An attacker could therefore use the channel to move information from a victim's environment into another ChatGPT account without relying on a conventional external network connection.

That distinction is important because traditional network monitoring may not identify the activity as an obvious outbound connection to an attacker-controlled server.

Why the Attack Could Be Difficult to Notice

The attack's stealthiness was one of its most concerning characteristics.

The victim could receive a completely normal answer to their question while the malicious workflow operated separately.

Researchers noted that the user interface could display a small indication that Gmail had been accessed, but this did not necessarily provide a meaningful warning because the access had already occurred.

OpenAI's current documentation explains that app permissions determine when ChatGPT asks for approval before accessing connected applications. Depending on the configured permission level, ChatGPT may automatically perform certain read operations while requiring approval for higher-risk actions.

This makes least-privilege configuration for connected AI applications particularly important.

Enterprise Security Implications

The research highlights a broader problem that organizations adopting AI assistants need to consider.

Traditional security models generally assume that a user explicitly initiates an action and that applications operate within defined trust boundaries.

AI agents introduce another layer: instructions can originate from content that the model processes rather than directly from the user.

A malicious instruction embedded in a shared document, conversation, custom GPT or other trusted source could potentially influence an AI agent that has access to sensitive corporate systems.

If that agent is connected to Gmail, Google Drive, Slack, Microsoft services, GitHub or other enterprise applications, the potential impact could extend well beyond a single conversation.

OpenAI's documentation confirms that connected apps can provide ChatGPT with access to external information and, depending on the integration, allow supported actions in those services. Workspace administrators can also control application availability and permissions.

Recommended Security Measures

Organizations using ChatGPT or other AI agents with connected applications should consider the following controls:

1. Apply Least-Privilege Access

Only connect applications and accounts that are genuinely required.

Avoid giving an AI assistant broad access to corporate email, cloud storage and business applications without a clear business requirement.

2. Review Connected Applications

Regularly audit which applications are connected to employee AI accounts and remove integrations that are no longer necessary.

OpenAI provides controls for reviewing and disconnecting connected applications.

3. Use Stricter Approval Policies

Where supported, organizations should consider requiring approval before AI applications access connected data.

OpenAI provides permission options including Always ask, allowing organizations or users to require confirmation before app access.

4. Restrict Custom GPTs and Shared AI Content

Enterprise administrators should establish governance around custom GPTs, shared conversations and externally sourced prompts.

Users should avoid blindly trusting instructions embedded in documents, conversations or AI-generated content.

5. Monitor OAuth and Application Activity

Security teams should monitor unusual activity involving:

• Gmail and Google Workspace
• Cloud storage
• OAuth applications
• AI platforms
• Custom AI agents
• Large or unusual data retrieval operations
• Unexpected access to sensitive repositories

6. Treat AI Instructions as Untrusted Input

Security awareness programs should teach employees that instructions displayed or processed by an AI system are not automatically trustworthy.

This is particularly important when AI tools have access to corporate data.

7. Review AI Governance Policies

Organizations should incorporate AI agents into existing security and compliance frameworks, including:

• Identity and access management
• Data loss prevention
• OAuth governance
• Third-party application management
• Security monitoring
• Incident response
• Data classification
• Zero Trust architecture

OpenAI Response

Check Point Research disclosed the issue to OpenAI.

According to the researchers, OpenAI confirmed that the internal service used to establish the demonstrated communication channel had been taken offline. Because the remediation was performed within the service infrastructure, there is no conventional client-side patch that users need to deploy.

The research was reportedly conducted in June 2026, although the disclosure does not establish exactly how long the communication channel was available before it was disabled.

Related Research Shows a Broader AI Security Challenge

This is not the first time researchers have identified unexpected communication paths involving ChatGPT's execution environment.

Check Point previously reported a technique involving DNS lookups that could be abused to move conversation data outside the environment. The researchers said OpenAI addressed that issue in February 2026.

The latest discovery is different because the demonstrated channel relied on a shared internal service rather than directly communicating with an external attacker-controlled server.

Both cases nevertheless illustrate the same architectural challenge: a service intended to support isolated AI workloads can potentially become an unintended communication layer between otherwise separated environments.