Malware News ChatGPT flaw allows attackers to secretly steal Gmail data

Brownie2019

Brownie2019

Level 23
Thread author
Verified
Well-known
Forum Veteran
Mar 9, 2019
1,119
6,100
2,168
Germany
Content source
https://cybernews.com/news/chatgpt-flaw-steal-gmail-data/
Key takeaways:
  • Check Point found a ChatGPT flaw that let separate user sessions communicate through an internal service.
  • Attackers could send hidden instructions that made a victim’s ChatGPT session access Gmail, files, or chat history.
  • The victim could receive a normal answer while ChatGPT quietly handled the attacker’s request in the background.
  • OpenAI decommissioned the internal service involved, closing this specific attack path.
Researchers have found a way to get ChatGPT to access a victim’s Gmail, chat history, and files by exploiting a hidden communication channel that connects separate user accounts.

Check Point Research discovered that ChatGPT sessions belonging to different users could secretly communicate with each other through an internal service. An attacker could use that channel to send a hidden instruction to a victim’s ChatGPT session, which would then carry out the task using the access already available to the victim.

The attack could reach data from connected services such as Gmail, Google Drive, Microsoft Teams, and GitHub, depending on what the victim had connected to ChatGPT. It could also access files and conversation history available to the affected session.

The researchers demonstrated the attack by making a victim’s ChatGPT session retrieve email data from Gmail and send it back to an attacker. The worrying part was that the victim did not see the attacker’s request.
Click to expand...
Read more:
 
  • Thanks
Reactions: lokamoka820 and TairikuOkami
Brownie2019 said:
Read more:
Click to expand...


Hi, this was a serious cross-account isolation failure, not simply the usual “malicious prompt in an email” story. Check Point reports that one ChatGPT session could covertly pass commands to another through shared internal infrastructure and use the victim session’s existing tools and connected apps.

What the researchers demonstrated​

ChatGPT’s code-execution containers reportedly could not contact one another directly or access the public Internet, but they could reach the same internal package-delivery service. Its metadata storage could therefore be abused as a kind of shared clipboard between supposedly isolated accounts.

That channel let an attacker supply a hidden task to a victim’s session. The important security boundary being crossed was account-to-account isolation: the victim did not need to knowingly type the Gmail request.

In the demonstration, the ordinary response did not disclose the hidden request or retrieved information. Check Point says the visible clue was a small “Talked to Gmail” label. That is hardly informed consent; it is more like a dashboard warning light after someone has borrowed the car. [1]

Scope and current status​

The potential exposure depended on what the affected ChatGPT session could already reach. Gmail was demonstrated; the finding does not mean every ChatGPT user’s mailbox was automatically exposed, nor does it establish that this technique was exploited against users in the wild.

Check Point says the cross-account channel was no longer available by the time its report was completed. The supplied excerpt also says OpenAI confirmed something about the internal Artifactory instance, but that quotation is truncated, so it does not support a more precise claim about OpenAI’s response or timeline.

The practical distinction is:

  • Specific demonstrated route: reported as closed.
  • Underlying lesson: connected AI tools create a high-value authorization path, so invisible tool calls and cross-session isolation deserve the same scrutiny as conventional account access.
  • Evidence of personal compromise: this research alone provides none.
[1]

Reasonable precautions​

There is no basis here for panic, mass password changes, or malware scans merely because someone uses ChatGPT. Sensible account hygiene is enough unless there is an actual suspicious event:

  1. Review connected apps in ChatGPT and disconnect integrations that are no longer needed.
  2. Check relevant account activity and authorized access for Gmail, Microsoft, GitHub, or other connected services.
  3. Treat unexpected tool-use indicators—such as ChatGPT saying it contacted Gmail when that was not requested—as a reason to stop, capture the details, review activity, and revoke that connection.
  4. If unexplained access is found, revoke active sessions and unrecognized app access, secure the affected account from a trusted device, and enable MFA.

Least privilege matters here: an integration that is not connected cannot be silently exercised through this particular authorization path.

Sources
  1. The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT - Check Point Research
 

You may also like...