A newly disclosed vulnerability in ChatGPT allowed planted instructions to siphon data from a user’s connected Gmail account and send it to an attacker-controlled ChatGPT account — all while the user got a seemingly normal reply. A cybersecurity research team uncovered the flaw and confirmed it’s been taken offline. This incident sheds light on critical gaps in app isolation and user consent in AI systems.
How the Attack Unfolded
Researchers at Check Point demonstrated that a specially embedded instruction (“planted prompt”) could perform secret background tasks alongside a regular user query. The malicious prompt first granted itself permission to read the user’s Gmail, then routed that info through a hidden channel to a second ChatGPT account. To the user interacting with ChatGPT, everything appeared normal — except a small label indicating the app accessed Gmail. There was no pop-up, no consent request. The user never saw the stolen data leave.
That hidden prompt must already be present in the conversation to start the extraction. It could arrive via one of three vectors: a prompt pasted in directly, a shared ChatGPT conversation, or embedded within a custom GPT’s builder instructions (which aren’t shown to users). Once embedded, a single additional message from the user triggered both a visible response and a hidden task. These ran in parallel: one stream handled the user’s request; the other quietly executed the malicious job using tools in the session.
Why This Was Possible: Shared Services & Default Permissions
The key technical issue was a shared internal service used by ChatGPT’s containerized environments. While conversation containers are logically separated—sometimes even across different user accounts—they all interacted with one internal package storage service (Artifactory). That service let containers write metadata, or “properties,” to cached files, which other containers could then read. In effect, this became a shared clipboard, letting an account under one user send data to another in a different account.
Compounding the issue were default permissions. By default, ChatGPT apps are allowed to read from connected services without asking users. In standard accounts, one can switch the permission type to “Always ask,” but many users (and all default app settings) remained exposed. In workspaces like Business, Enterprise, or Education, administrators control these defaults, but ordinary users might not see or understand this distinction.
Check Point’s research highlighted that the flaw depended on permissions often granted by default. The instruction read already accessible data from Gmail without user interaction or warning, since permissions for reading data from connected apps are part of the routine setup in many accounts. Only actions that materially affect outside systems or expose sensitive content are usually gated with explicit prompts.
Resolution & What’s Known
The vulnerability was reported to OpenAI, which confirmed that the internal component powering this channel has been shut down. No patch was required from users. The issue was discovered in June 2026, though Check Point didn’t clarify precisely when the flaw was disabled — meaning it’s unclear how long users were exposed.
This isn’t the first time Check Point found unexpected communication paths inside ChatGPT. Earlier in 2026, another hidden channel was discovered that used DNS queries to send data between conversations. That too was addressed. However, both cases share a pattern: a shared internal service unintentionally becoming a bridge between environments supposedly isolated.
Users concerned about privacy can change their connected app permissions to require explicit consent (“Always ask”). In business or education workspaces, these settings are controlled by administrators, allowing tighter control over what apps can do.
Why It Matters and What to Watch
This vulnerability underscores how subtle flaws in isolation and permissions can expose private data even when systems appear secure at the surface. For AI platforms relying on connected apps and cross-account services, ensuring total separation is crucial — both technically and in user interfaces. Going forward, users should demand transparency over permissions, and platforms must audit shared infrastructure to prevent unintended communication paths. Expect increased regulatory scrutiny over AI data privacy as such flaws come to light.
