Planted ChatGPT Prompt Could Exfiltrate Connected Gmail Data
Check Point Research disclosed a ChatGPT flaw in which a single instruction planted in a conversation could cause the service to read data from a user’s connected Gmail account and transfer it to a second ChatGPT account. The visible response could remain a normal answer to the user’s request, while the hidden activity ran in parallel.
In Check Point’s proof of concept, the same mechanism could also extract chat history and files attached to the conversation. The potential scope depended on the data, tools, connected applications and permissions already available in the affected ChatGPT session.
How the hidden instruction was delivered
The malicious instruction had to be present in the conversation before the activity began. Check Point identified three possible delivery paths: text pasted by a user, a shared ChatGPT conversation opened by a user, or builder instructions in a custom GPT. Builder instructions are not visible to the user.
Once installed, the instruction directed ChatGPT in Thinking mode to perform two streams of work during one turn. It answered the user’s message while separately checking for an attacker task, using tools available in the user’s session, and returning the result through a concealed channel. The only visible indicator could be a small “Talked to Gmail” label shown after a read had already occurred.
Internal package service became a cross-account channel
ChatGPT creates a code container for a conversation when a task requires it. OpenAI documentation states that the Python environment used for data analysis cannot call the web or external APIs, and Check Point said separate containers did not have a direct route to one another.
However, the containers could reach an internal JFrog Artifactory service used to obtain Python or npm packages. Check Point found that a container could attach named metadata properties to a cached file and retrieve them later. The credentials supplied for reading those properties were also sufficient to write them, and the relevant values were available through environment variables to code run by ChatGPT.
In the demonstration, a container in one account wrote a timestamp property to a cached file. A conversation under another account retrieved the same property and value. Because properties could hold plain text or Base64 data, with larger payloads split across several properties, the researchers described the service metadata as a shared clipboard across containers intended to remain isolated.
OpenAI response and permission implications
Check Point said it reported the issue to OpenAI, which confirmed that the internal service underpinning the channel had been taken offline. There is no update for users to install. The report dates the research to June 2026 and does not establish how long the channel was available.
Connected-app settings remain important because ChatGPT can read from an app under its default Important actions permission without requesting confirmation. Users can select Always ask, while Business, Enterprise and Edu administrators can define permitted app actions and eligible users. Organisations should review connected-app access, restrict use of untrusted shared chats and custom GPTs, and apply confirmation settings appropriate to the sensitivity of the data exposed to ChatGPT.