Security researchers discovered a ChatGPT flaw that could allow attackers to access another user’s Gmail messages, files and conversation history. The attack used a hidden communication channel between isolated ChatGPT sessions and could operate without showing the victim the malicious request.
OpenAI has since decommissioned the internal service behind the vulnerability, closing this specific attack route.
Separate ChatGPT Sessions Could Communicate
Check Point Research found that ChatGPT sessions linked to different accounts could exchange information through a shared internal service. This unexpected connection allowed an attacker to send hidden instructions to a victim’s session.
The victim’s ChatGPT session could then perform the requested task using its existing permissions. Depending on the connected services, the attack could reach Gmail, Google Drive, Microsoft Teams, GitHub, uploaded files and previous conversations.
Researchers demonstrated the vulnerability by instructing a victim’s session to retrieve email information from Gmail. The session then returned the collected data to the attacker without displaying the malicious request to the victim.
Ordinary Prompts Could Trigger Hidden Tasks
Attackers could deliver an instruction through a malicious prompt, shared ChatGPT conversation or custom GPT. After the hidden request reached the victim’s conversation, the victim only needed to submit a normal message to activate it.
For example, a user could ask an ordinary question and receive an expected response. Meanwhile, ChatGPT could process the attacker’s separate instruction in the background.
As a result, the visible answer offered no clear warning that another task had taken place. In the Gmail demonstration, the victim only saw a small notice indicating that ChatGPT had communicated with Gmail. However, this label appeared after the system had already accessed the data.
Internal Service Became a Shared Clipboard
ChatGPT runs some operations in isolated code-execution environments known as containers. These containers could not communicate with each other directly. However, they shared access to an internal JFrog Artifactory service that distributed software packages.
Researchers discovered that the service could also store and retrieve small amounts of data. A container associated with one ChatGPT account could write information that another account’s container could later access.
Check Point described the mechanism as a hidden shared clipboard. The researchers converted it into a two-way communication channel between otherwise separate user accounts.
An attacker could store an instruction in the shared location. The victim’s session could then retrieve the task, execute it and return the requested information through the same channel.
Connected Apps Increased the Potential Impact
The impact of the ChatGPT Gmail flaw depended on the permissions granted to the victim’s session. Accounts connected to email, cloud storage or workplace platforms presented more opportunities for attackers to access sensitive information.
Some connected-app settings also allowed ChatGPT to approve read operations automatically when the system considered them low risk. Consequently, the victim might not receive a confirmation request before the assistant accessed data.
Check Point said the vulnerability could effectively turn an AI assistant into a coerced insider. The assistant already had legitimate access to the victim’s information, but an attacker could secretly influence how it used those permissions.
Previous Research Found Another Data Leak
The finding follows an earlier ChatGPT vulnerability that also involved malicious prompts and covert communication. That flaw allowed attackers to extract information from conversations and uploaded files before sending it to an external server.
However, the newer attack introduced a different threat. Instead of only creating a path for data to leave the platform, it allowed one ChatGPT account to send instructions to another.
The risk becomes more significant as AI assistants gain access to email accounts, cloud files and workplace systems. Broader permissions make these tools more useful, but they can also increase the damage if attackers manipulate their behaviour.
OpenAI Closed the Attack Path
OpenAI decommissioned the internal Artifactory service involved in Check Point’s research. This action removed the shared communication channel and closed the specific attack route demonstrated by the researchers.
The discovery still highlights the security challenges surrounding AI assistants with access to connected accounts. Isolation between users must cover every shared internal service, especially when an assistant can retrieve sensitive information on a user’s behalf.
0 responses to “ChatGPT Flaw Let Attackers Secretly Access Gmail Data”