Check Point: ChatGPT flaw let attackers steal Gmail data via hidden cross-account channel

Security researchers at Check Point have demonstrated a flaw in ChatGPT that let an attacker pull data from a victim's Gmail account through a covert channel connecting user accounts that were supposed to be fully isolated. According to a write-up published on dev.to in September 2026, which builds on reporting by CSO Online, OpenAI has since patched the flaw and shut down the internal service involved.

How the hidden channel worked

ChatGPT's code execution feature runs each user's work in its own container, and those containers are designed so that no session can reach another. To let the sandboxes install software packages, however, OpenAI funnels install requests through an internal service built on JFrog's Artifactory.

Check Point found that every container could write to, and read back, the metadata attached to package submissions in that shared service. In effect, the metadata acted as a noteboard linking sandboxes that were meant to be sealed off from one another.

What the attack could do

With write access to that shared metadata, an attacker could plant a task inside another user's session. As the dev.to write-up describes it, a crafted instruction caused the victim's session to carry out additional work in the background while the victim carried on a normal conversation.

In the demonstration, the hidden instruction told ChatGPT to fetch data from the victim's connected Gmail account and hand it to the attacker. Everything on the victim's screen looked ordinary; the covert work produced no prompt and no warning.

How far the technique reaches depends on what the victim's account is authorized to touch. Beyond Gmail, the report points to connectors for Google Drive, Microsoft Teams and GitHub as potential targets.

Check Point frames the result as an "insider threat by proxy": the AI system itself was never breached. Instead, it was steered into acting against the user's wishes while operating inside the trust boundary the organization had already granted it.

The one trace a user might see

The only evidence that surfaced was a small "Talked to Gmail" label, recorded after the access had already taken place. That near-total absence of visible signal is what makes the pattern worrying, the researchers argue.

A common thread with the Hugging Face intrusion

Check Point also disclosed that its test predated a separate incident on the same Artifactory-based service, one that led to the Hugging Face intrusion OpenAI later acknowledged publicly. The two events relied on different techniques, but both traced back to the same shared piece of internal infrastructure.

An IDC analyst cited in the coverage argued that repeated failures to isolate data on legacy infrastructure should change how organizations evaluate vendor risk.

What organizations can do now

The analyst's suggested steps do not depend on vendors acting first. Grant connectors the narrowest scope possible, since authorizing calendar access without also exposing Gmail and Drive limits how much any leak can expose. Route connected-app traffic through data inspection so sensitive material is caught before it leaves. Log every read and write, with timestamps and data types, and feed those records into your own incident management tooling. Without that logging, the analyst noted, leaks of this kind would remain invisible even after the underlying flaw is repaired.

Two caveats from the write-up are worth keeping in mind. First, the flaw is fixed and the service is gone, so the value here is the risk pattern rather than the specific bug. Second, the attack required knowledge of OpenAI's internal infrastructure and worked only under particular conditions, so it was not a casual, drive-by exploit.

Why it matters

This is a rare documented case of a widely used AI assistant being abused as the transport layer for data theft between real accounts, rather than a purely theoretical prompt-injection exercise. It shows that once an AI system is wired into mail, files and workplace chat, every connector widens the attack surface, and that isolation guarantees at the infrastructure level, not just at the model level, determine whether those connections can be abused. The question the analyst suggests putting to vendors is how many data-isolation failures they have logged in the past twelve months and what structural changes followed each one. For individuals and teams alike, the practical takeaway is least privilege: audit which apps are connected to your accounts and disconnect the ones you no longer use.