A recent security vulnerability in OpenAI’s ChatGPT has been revealed, aligning with research by Check Point which described a method for attackers to harvest data from a victim’s connected Gmail account. This flaw exploited covert communications between separate user sessions, allowing unauthorized access to sensitive information.
In a proof-of-concept demonstration, Check Point illustrated that a victim's ChatGPT session could naively retrieve email data, transferring it to an attacker-controlled session during a typical interaction. “The research uncovered a cross-account command channel through which an attacker manipulated a victim’s ChatGPT session into executing tasks with the data and tools associated with that session,” explained Check Point researcher Alexey Bukhteyev in their report. OpenAI has acknowledged the issue and confirmed that the vulnerable internal service has since been deactivated.
Check Point characterized this incident as a “coerced insider” situation, wherein the AI tool is not itself compromised but is leveraged to perform unintended actions within secure parameters. The impact wasn't limited to Gmail; the flaw could extend to any service the victim had authorized, encompassing Google Drive, Microsoft Teams, and GitHub integrations.
A Covert Cross-Account Channel
The root cause of this vulnerability resides in ChatGPT's code execution environment, where user tasks are typically isolated within individual containers. OpenAI’s routing of requests for package installations through an internal service allegedly based on JFrog Artifactory inadvertently created a shared metadata zone among these containers.
While conventionally isolated, Check Point discovered that these containers could in fact read and write to the same metadata space, which it likened to a shared clipboard among isolated systems. Consequently, attackers could leverage this shared metadata to covertly transmit tasks from their session to that of a victim's, allowing for hidden instructions that the victim remained oblivious to, while still receiving normal responses.
Gmail Data Accessed Without User Awareness
During the security analysis, Check Point pinpointed that hidden commands could instruct ChatGPT to access a victim's Gmail and relay data to an attacker’s session. The responses presented to the user appeared completely typical, masking any indication that unauthorized access occurred.
The attack's breadth rested on the permissions granted to the victim’s session. Users were largely unaware, receiving minimal feedback—merely a label stating 'Talked to Gmail'—which surfaced post-action, offering no real-time alerts or awareness of the breach.
Issue Tied to the Same Infrastructure
Check Point also noted that this vulnerability was not isolated; it shared a common infrastructure link with another incident involving Hugging Face, which has been publicly acknowledged by OpenAI. Though differing in technique, both vulnerabilities met at the same critical service, raising important questions about inter-container communication security.
Shilpi Handa, associate research director at IDC, underscored the implications for corporate vendors, advising that CIOs should interrogate AI suppliers about cross-tenant communications risks. Questions surrounding whether one container’s actions could inadvertently impact another are now paramount for companies evaluating vendor security profiles.
Controls That Enterprises Can Apply Now
In light of these discoveries, it’s clear that enterprises can take immediate steps to mitigate potential risks without waiting for vendor assurances. Handa recommends a conservative approach to authorizing app connections—enabling access narrowly rather than broadly. For instance, permitting calendar integration without also linking Gmail and Google Drive could significantly limit exposure in the event of a breach.
Beyond initial access control, organizations should consider deploying Data Loss Prevention (DLP) or Cloud Access Security Broker (CASB) technologies that supervise connected app traffic to protect sensitive data in transit. Implementing logging mechanisms for all app interactions—including timestamps and data classifications—adds an extra layer of oversight to catch threats before they materialize. Without such logging, detection of similar data leaks might remain elusive even after the underlying issues are patched.
There are also provisions within some vendor admin consoles that permit customization of risk profiles for applications, requiring explicit consent for data access involving Gmail or Google Drive. This protective layer is particularly critical for handling sensitive information from areas such as HR, finance, or legal departments—and is worth instituting immediately.
