A vulnerability in OpenAI's ChatGPT enabled attackers to extract data from a victim's connected Gmail account by transmitting concealed instructions between different user sessions, according to research from Check Point. In a proof-of-concept demonstration, Check Point showed that a victim's ChatGPT session could pull email data and transmit it to an attacker-controlled session during a single, apparently routine interaction. OpenAI has since resolved the issue and decommissioned the internal service involved, the report confirmed.
The weakness originated in ChatGPT's code execution environment, where operations run inside isolated containers linked to individual user accounts. To enable software installation within those containers, OpenAI directed package requests through an internal service built on JFrog Artifactory. Though containers weren't supposed to communicate with one another, Check Point discovered each container could write and read metadata in that shared service, effectively creating a shared clipboard between containers meant to be separated. By writing instructions into that shared metadata, an attacker's session could pass tasks to a victim's session, making the victim's ChatGPT session quietly process a second stream of tasks alongside the conversation the victim could actually see. The attack's scope extended to anything the victim's session was already authorized to access, including Google Drive, Microsoft Teams, and GitHub connectors, not just Gmail. User awareness was minimal—the only indication observed was a small label "Talked to Gmail" showing that an external service had been accessed, logged after the action had already taken place.
Check Point researcher Alexey Bukhteyev wrote that the team "discovered a covert cross-account command channel through which an attacker could use a victim's ChatGPT session to execute hidden tasks." Check Point described this as a "coerced insider" scenario, where the AI system itself isn't compromised but can be manipulated into performing unintended actions within the organization's trust boundary. In the demonstration, the visible answer looked completely ordinary even as the hidden task executed in parallel. Check Point Research noted its proof of concept was already working before a separate chain of activity on the same Artifactory instance led into the Hugging Face compromise that OpenAI has since disclosed publicly—the two incidents used different techniques but trace back to the same shared internal service.
Shilpi Handa, associate research director at IDC, said a repeat isolation failure on the same infrastructure changes how enterprises should weigh vendor risk. She recommended CIOs should ask AI vendors directly whether one tenant's container can read or write data another tenant's container can also access, since customers can't verify this independently. Handa also said enterprises should ask vendors how many isolation-boundary findings they've logged over the past 12 months and what changed structurally after each one. She recommended enterprises authorize connected apps narrowly rather than by default, route connected-app traffic through DLP or CASB inspection to catch regulated data before it leaves the pipeline, and require an API or webhook that logs every connected-app read and write with timestamp and data category exported to the enterprise's own SIEM. Without that logging, she said, enterprises can't detect this class of leak even post-patch. The risk is especially acute for organizations that have already granted ChatGPT broad access to collaboration tools and cloud storage without implementing granular monitoring at the boundary. For enterprises navigating the governance gap between AI adoption speed and security maturity, the lesson is straightforward: trust models built for human insiders don't automatically extend to agentic systems that can be instructed remotely.