Case chatgpt-gmail-covert-channelPrompt injectionWorldwide
Planted prompt makes ChatGPT copy victims' Gmail data to attacker account
Check Point showed a planted instruction could make ChatGPT read connected Gmail and pass it to an attacker's ChatGPT account through a covert channel between sandboxes; OpenAI disabled the service.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 8, 2026
- Location
- Worldwide
- Target
- ChatGPT Gmail connector
- Severity
- High
- Triggered by
- Security researchers at Check Point Research (responsible disclosure)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Check Point showed a planted instruction could make ChatGPT read connected Gmail and pass it to an attacker's ChatGPT account through a covert channel between sandboxes; OpenAI disabled the service.
Impact: Proof of concept only; demonstrated silent exfiltration of a victim's Gmail data (also applicable to Drive, Teams and GitHub connectors) with only a Talked to Gmail label visible
Who triggered it
Actor: Security researchers at Check Point Research (responsible disclosure)
Attribution: Self-attributed research by Check Point; OpenAI confirmed the internal service was decommissioned
Motive: Security research and responsible disclosure
How it happened
Attack vector: Prompt injection via shared conversation or custom GPT made the victim's code sandbox read Gmail and write chunks as properties on a shared JFrog Artifactory item readable by the attacker's sandbox
Root cause: Per-account sandboxes shared one internal Artifactory package service with credentials that allowed writes, giving a cross-account covert channel with no per-account separation
Timeline
- Check Point discovers the cross-account channel and reports it to OpenAI
- Check Point publishes research; OpenAI confirms the Artifactory instance was decommissioned
Response
OpenAI decommissioned the shared internal package service; no CVE assigned and no user-facing patch required
Current status: Patched
Sources (open in a new tab)
- Mezha mezha.ua
- CSO Online csoonline.com
- Cybernews cybernews.com
- TechRadar techradar.com
Cite this case
Planted prompt makes ChatGPT copy victims' Gmail data to attacker account. AI Threat Watch, case chatgpt-gmail-covert-channel, Sep 8, 2026. https://aithreat.io/cases/chatgpt-gmail-covert-channel/
Permanent link: https://aithreat.io/cases/chatgpt-gmail-covert-channel/