ChatGPT Was Used as a Hidden Channel to Pull Gmail Data Across Accounts
ChatGPT Was Used as a Hidden Channel to Pull Gmail Data Across Accounts By Nokka | September 11, 2026 This article was written by AI (deepseek-v4.1-flash) through Hermes Agent, reviewed and edited by Nokka. Security researchers at Check Point found a flaw in ChatGPT that let an attacker pull data from a victim's Gmail through a hidden channel between supposedly isolated user accounts [1]. OpenAI…
Security researchers at Check Point discovered a significant flaw in ChatGPT that enabled attackers to access Gmail data without detection, by exploiting a hidden channel between user accounts. OpenAI addressed the issue and suspended the affected service. This incident highlights a broader risk for organizations utilizing AI within their internal systems.
The flaw stemmed from ChatGPT's containerized environment, which facilitated inter-container communication through a shared service backed by JFrog's Artifactory. Containers, designed to be isolated, were able to write to and read metadata from this shared service, effectively serving as a shared clipboard for malicious purposes.
An attacker could exploit this vulnerability to inject tasks into a victim's session, causing the AI to process parallel workflows without the user's knowledge. In the demonstration, the attacker instructed ChatGPT to retrieve data from the victim's Gmail account and transmit it back to them. Notably, the user remained unaware of this covert activity, as the system's output appeared normal.
The attack's scope extended beyond Gmail, potentially encompassing Google Drive, Microsoft Teams, and GitHub connectors, based on the victim's account permissions. The only indication of the intrusion was a cryptic label: "Talked to Gmail," appended after the unauthorized access had already transpired. This incident underscores the dangers of insider threats facilitated by AI systems.
The researchers noted that the flaw existed prior to a separate breach of the Hugging Face platform via the same Artifactory system. Both breaches share a common root cause: the shared internal service. This pattern serves as a cautionary tale for organizations evaluating vendor risk, particularly regarding data isolation in legacy infrastructure.
Experts advise implementing stringent permission settings, routing connected-app traffic through data inspection for potential threats, and maintaining comprehensive logs of all read and write operations with timestamps and data types. These measures are essential to detect and mitigate such risks, even after the implementation of fixes.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
