ChatGPT Flaw Could Let Attackers Steal Gmail Data Across User Accounts

Severity
Medium

Detail

Security researchers from Check Point Research, led by researcher Alexey Bukhteyev, discovered a flaw in ChatGPT’s isolation architecture that could have allowed attackers to access data from a victim’s connected applications and transfer it to a separate ChatGPT account through a hidden cross-account channel.

Attackers could embed instructions within a shared ChatGPT conversation, malicious prompts or custom GPT configurations. When a victim interacted with the affected conversation or GPT, ChatGPT could perform hidden tasks alongside the user’s legitimate request.

Although the visible response could appear normal, information retrieved from connected applications could be transferred to the attacker without being displayed in the chat output. The issue involved ChatGPT’s isolated containers, which are used for activities such as analysis, file processing and dependency installation. Researchers found that these containers could access a shared internal JFrog Artifactory service.

The Artifactory service was intended to provide software dependencies to the containers. However, its Item Management API endpoints also allowed container credentials to set and read metadata properties associated with cached repository items. Researchers demonstrated that this functionality could be abused as a cross-tenant communication mechanism, allowing data to be written to shared cached files and later retrieved by a container associated with another ChatGPT account.

How?

The attack relied on a covert channel created through mutable metadata within the shared internal Artifactory service. A container associated with one ChatGPT account could attach text or Base64-encoded data to a shared cached file using metadata properties. A container associated with another account could then query the same item and retrieve the stored information.

Larger data could be divided into multiple chunks and reassembled by the receiving environment. Check Point described this mechanism as a “shared clipboard” between containers that were intended to remain isolated.

Researchers then combined this cross-account channel with prompt injection. An attacker could place hidden instructions inside a shared ChatGPT conversation or custom GPT configuration. When a victim submitted a normal request, ChatGPT could process the legitimate request while also retrieving an attacker-controlled command through the covert channel.

In a proof of concept, a victim had connected Gmail to ChatGPT. During an unrelated request, ChatGPT accessed the connected Gmail mailbox, retrieved requested email data, and transferred it back to the attacker through the Artifactory-based channel. The victim received a normal response and did not see the hidden Gmail query in the visible output. The only potential indication was a “Talked to Gmail” activity label, which did not provide an opportunity to approve or block the access beforehand.

Impact

The flaw could allow attackers to obtain data accessible to a victim’s ChatGPT session without directly communicating with the victim’s container or using the public internet. In the demonstrated scenario, Gmail data could be retrieved from a victim’s connected mailbox and transferred to another ChatGPT account. The potential exposure depended on the applications, tools, files, and permissions available to the victim’s ChatGPT session.

Beyond Gmail, potentially accessible data could include information from:

• Google Drive
• Microsoft Teams
• GitHub
• Uploaded files
• Chat history

The research also demonstrated that data could be transferred between ChatGPT accounts through the shared internal service without being visible in the normal chat output.

According to Check Point, OpenAI was notified of the issue and confirmed that the internal Artifactory instance involved in the research had been decommissioned. By the time the report was published, the cross-account communication channel was no longer active.

Recommendation

Organizations should implement:

• Strict tenant separation.
• Least-privilege access.
• Explicit approval controls for connected-application data access.

Conclusion

The research demonstrated that weaknesses in shared internal services could undermine isolation between ChatGPT containers and accounts. By combining writable metadata in a shared Artifactory service with prompt injection, attackers could create a covert cross-account channel capable of transferring data from connected applications such as Gmail.

The issue was addressed after OpenAI decommissioned the internal Artifactory instance involved in the research, and the cross-account channel was no longer active at the time of publication.

Source

https://gbhackers.com/chatgpt-flaw/
https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/