ChatGPT Flaw Let Attackers Read Gmail via Hidden Cross-Account Channel, Researchers Say

The flaw centers on persuasion rather than exploitation of a conventional vulnerability. Researchers described it as persuading an AI agent that already holds legitimate credentials to act on malicious instructions embedded in shared internal data.

CPR said the issue sits in how ChatGPT handles code execution. When an agent must run code, it does so in an isolated container, and installing software may require package downloads. Rather than giving containers direct internet access, OpenAI routes package requests through an internal JFrog Artifactory instance. Containers from different user accounts are prevented from communicating directly, but they can reach the same internal service, which lets containers attach text or binary properties to a repository item. As a result, any container can read back properties written by any other container.

In effect, the package-delivery metadata became a shared clipboard between containers that were meant to be isolated from one another. CPR confirmed the isolation gap by writing a property from one account’s container and reading it moments later from a different account’s container. Data too large for a single property was split into chunks and reassembled at the receiving side.

From there, the exploit becomes a form of prompt injection. The attacker leaves a malicious instruction in the shared internal storage and then sends a prompt or shared conversation that tells the victim’s agent to check that storage during its next ordinary reply. The agent reads the attacker-controlled text, follows it, and keeps answering the victim normally. CPR says the user would see the requested answer while the agent silently uses its connected accounts to transmit the stolen data.

The scope of data an attacker can steal depends on what services the victim has linked to the assistant. The available footprint includes Gmail, Google Drive, Microsoft Teams, GitHub, and similar connected applications. In CPR’s demonstration, ChatGPT retrieved email data from a victim’s connected Gmail account and delivered it to an attacker-controlled session within a single turn of conversation.

The researchers disclosed the findings to OpenAI, which CPR says confirmed the specific path has been closed. However, CPR argues that the architectural pattern behind the flaw could exist on other platforms. “Any AI assistant that operates inside an organization’s trust boundary, holding credentials, running code, and reaching connected services, can become what Check Point Research calls a coerced insider,” the report states. “The model itself does not need to be malicious. It only needs to be persuaded, through text it was never meant to trust, to use access that was granted for entirely legitimate reasons.”

For businesses, CPR advises tracking which AI tools employees use and what those tools have access to. Companies should govern what AI assistants and agents are allowed to do and monitor their actions, not just the text output they produce.