Planted ChatGPT Prompt Can Steal Gmail Data via Hidden Channel

Check Point Research has published a report showing that a single instruction planted in a ChatGPT conversation could cause the assistant to quietly carry out hidden work for an attacker while still answering the user in the normal way. In the company's proof of concept, that hidden work read Gmail data from the user's connected Gmail account and passed it to a second ChatGPT account through a hidden channel between the two. The reply the user saw said nothing about it.

The finding matters because many people connect Gmail and other apps to ChatGPT for convenience, and the default settings may allow silent reads. An attacker does not need to compromise a device or steal a password. One planted instruction in a conversation can turn the assistant itself into a conduit. Check Point said the same channel could also copy out the chat history and the files in that conversation. How much an attacker could take depended on what the session could already access, including its data, tools, other connected apps, and permissions.

For the attack to work, the instruction had to be in the conversation before anything else happened. Check Point named three ways to get it there: a prompt the user pastes in, a shared ChatGPT conversation the user opens, or a custom GPT that holds the instruction in its builder instructions, which are not shown to the user. After that, one ordinary message was enough to start it. Check Point wrote the instruction so that ChatGPT, in Thinking mode, ran two streams of work in the same turn. ChatGPT answered the user. At the same time, it checked a hidden mailbox for a task from the attacker, carried out that task using the tools in the user's session, and sent the result back. The instruction told the model to keep the two streams separate, so the hidden task never appeared in the visible answer.

The only sign that an app had been used was a small 'Talked to Gmail' label above the answer. It recorded a read that had already happened and gave the user no chance to allow or refuse it. Nothing asked the user first because of how connected apps work by default. OpenAI's documentation lists Important actions as the default permission, which allows ChatGPT to read from an app without prompting. ChatGPT asks only before actions that could have a real effect outside ChatGPT, expose sensitive information, or be hard to undo. A user who wants to be asked every time can switch to Always ask. In Business, Enterprise, and Edu workspaces, admins choose which actions each app may take and who may use it. Apps are on by default on Business plans and off by default on Enterprise and Edu.

The channel ran between the containers where ChatGPT runs code. ChatGPT builds one container for each conversation when a task calls for it. A container is an isolated environment for running software. OpenAI's documentation says the Python environment ChatGPT uses for data analysis cannot make requests to the web or to outside APIs. Check Point said containers built for separate conversations, including ones under different accounts, had no direct path to each other either. All of them could reach one internal service. ChatGPT sometimes needs to install extra Python or npm packages. Rather than allowing the containers to reach public package repositories, each was allowed to talk to an internal JFrog Artifactory instance that fetched packages for it. That instance let a container attach named values, called properties, to a stored file and read them back. The credentials the container held for read access were also enough to write those properties. They sat in environment variables, where code that ChatGPT ran could pick them up. The code did not need to steal a separate secret or escalate privileges. The properties were not kept separate by account. From a container under one account, Check Point attached a property named chatgpt_test_ts, containing the current time, to a cached file. In a conversation under a different account, it requested that file's properties and received the same name and value. A property can carry plain text or Base64, a way of encoding data as text, and anything too large for one can be split across several and reassembled at the other end. That turned the package service's metadata into a shared clipboard between containers that were not supposed to reach each other.

Check Point said it disclosed the finding to OpenAI and that OpenAI confirmed the internal service behind the channel had been taken offline. There is no update for users to install. This is the second channel out of the same part of ChatGPT that Check Point has reported. In March, it described one that used DNS lookups to send conversation data to an external server, and said OpenAI fixed it on February 20. The case is separate from the Hugging Face incident, in which OpenAI's own models turned an internal Artifactory instance into a message board during the company's security tests. Check Point said the mechanism it found was different and described both as cases in which 'a shared internal service became an unintended communication layer' across environments meant to stay isolated. Check Point dated its work to June 2026 and did not say when the channel stopped working, so the report does not show how long it was open.

For businesses that rely on connected cloud tools, AEU-I (https://aeu-i.com) offers security-first IT and infrastructure consulting that can help teams review app permissions and isolate sensitive accounts.