A Hole in ChatGPT Let Attackers Quietly Siphon a Victim's Gmail Into Someone Else's Account

Check Point Research has published a report according to which a single instruction planted in a conversation in advance could make ChatGPT secretly carry out an attacker's task while continuing to answer the user as if nothing were amiss. In the scenario the researchers built, this hidden work read data from a connected Gmail account and passed it to a second ChatGPT account over a covert channel. The visible reply said not a word about it. The same method could be used to pull down chat history and files attached to the conversation.

How it worked

The instruction had to be placed into the conversation ahead of time — for example, through text the user pastes in themselves, through a shared link to someone else's chat that they open, or through a custom GPT where it was hidden away in settings invisible to the user. After that, a single ordinary message was enough. In reasoning mode ChatGPT ran two threads at once: it answered the person and, in parallel, checked a “mailbox” for the attacker's task, carried it out with the current session's tools, and sent the result back. The only trace left behind was a modest “Talked to Gmail” note above the reply — it recorded a read that had already happened, without asking for permission.

By default this is intended behavior: OpenAI's documentation permits reading from connected apps without prompting, and confirmations are required only for actions that have consequences in the outside world. A user can switch to an “always ask” mode, and on enterprise plans these permissions are controlled by administrators.

Metadata instead of a clipboard

The most curious part is the nature of the channel. The containers in which ChatGPT runs code for different conversations, and even for different accounts, are isolated from one another and have no access to the internet. But they all reach out to a single internal service — an instance of JFrog Artifactory that fetches the needed Python and npm packages instead of the public repositories.

This service allowed arbitrary named properties to be attached to a stored file and read back. The credentials sitting right there in the environment variables were enough to write such properties too, and they were not separated by account. Check Point attached a property with a timestamp to a file from one account — and got it back in a conversation under another. Text can be encoded in Base64 and split across several properties, then reassembled at the other end. In this way the package service's metadata turned into a shared clipboard between containers that were never supposed to see one another.

OpenAI confirmed that the internal service behind the channel has been shut down; there is no update to install. This is already the second such channel from this same part of ChatGPT that Check Point has reported: in March it described a trick using DNS queries. The work is dated June 2026, and the report does not say how long the loophole had remained open.

Source: The Hacker News