Security researchers at Check Point Research identified a vulnerability in ChatGPT that, under specific conditions, could allow data from services connected to a user account to be retrieved and passed to another account. The researchers demonstrated the attack using Gmail. OpenAI was notified and disabled the infrastructure used in the proof of concept.
The issue was not a vulnerability in Gmail itself. It concerned the technical environment in which ChatGPT could execute code and interact with connected services. Separate user environments should be isolated, but researchers found a shared infrastructure component that could be abused to move information between them.
How the attack could expose Gmail data
The risk was significant because a user did not have to knowingly ask ChatGPT to disclose information. A malicious instruction could cause the system to perform an additional operation while still returning an apparently normal response.
In the demonstration, ChatGPT had authorised access to Gmail. A hidden instruction could trigger retrieval of information from the mailbox and then transfer the result through infrastructure accessible from a session controlled by the attacker.
This did not mean an attacker could automatically break into any Gmail account. The system could only access services and information for which the user had already granted permissions.
A shared component created a cross-account channel
According to Check Point Research, separate ChatGPT environments could interact with a shared internal JFrog Artifactory service. Artifactory is normally used to store and distribute software components.
The researchers found that information written through the service from one environment could be retrieved from another. In practice, this created a communication channel between user environments that were expected to remain isolated.
The finding matters for companies because AI assistants increasingly connect to email, documents and other business systems. The security boundary therefore extends beyond the model itself to the infrastructure that executes actions and handles permissions.
The risk depended on existing permissions
The vulnerability did not involve stealing a Google password or bypassing Gmail authentication. It relied on permissions already granted to ChatGPT. If email was connected, mailbox information could potentially be exposed; if other services were connected, data available through those integrations could also be relevant.
For organisations deploying AI assistants, the case reinforces the need to limit application permissions to what is actually required, periodically review connected services and treat AI integrations as part of the wider access-control environment.
OpenAI disabled the affected infrastructure
Check Point reported the issue to OpenAI. According to the researchers, the internal service used to establish the cross-account channel was disabled, meaning the demonstrated attack path is no longer available in the same form.
The incident nevertheless highlights a broader security challenge. As AI assistants gain access to corporate email, files and applications, isolation between users and strict permission controls become as important as the security of the AI model itself.
Source: Check Point Research.
