Check Point Research disclosed Tuesday that a weakness in ChatGPT’s code-execution sandbox let data from one user’s connected Gmail account be moved into a separate, attacker-controlled ChatGPT account, with no confirmation prompt shown to the victim.
The flaw sat not in the model but in the infrastructure beneath it. Containers running individual conversations cannot address one another directly, Check Point found, but every container could reach the same internal JFrog Artifactory instance OpenAI used for package management. An item-management feature there let any container attach text metadata properties to cached items and read properties written by others, turning a package cache into a two-way message board between environments meant to be isolated.
How the Chain Worked
The attack starts with an instruction the victim never sees. Researchers demonstrated three delivery routes, any one of them was sufficient. First, a prompt pasted into a chat, second was a shared conversation link, or third, a custom GPT carrying a hidden instruction.
The victim’s session then quietly processes a second stream of tasks alongside the conversation they can actually see. In one demonstration described by The Register, the user got an ordinary answer, a temperature chart, while an injected task told the session to use the Gmail connector and list their messages.
Those instructions reach whatever the victim has connected. Researchers cited Gmail, Google Drive, Microsoft Teams and GitHub in their findings.
The decisive detail is the permission model. ChatGPT’s default connected-app setting automatically approves read actions it judges low risk, with no separate confirmation step. The only trace researchers observed was a small “Talked to Gmail” label appearing afterward. Harvested data went into the shared metadata channel and was collected by the attacker’s own session — exfiltration that never touches the victim’s browser or their employer’s network egress, leaving nothing for conventional data-loss prevention tools to inspect.
Also read: New ChatGPhish Technique Uses Prompt Injection to Manipulate ChatGPT Responses
The Hugging Face Connection
Check Point reported the channel to OpenAI in late June and says it had a working proof of concept before the activity that led to the Hugging Face compromise OpenAI has since disclosed. The two are separate attacks using different techniques, but both ran through the same internal Artifactory instance. On disclosure, OpenAI told Check Point the instance had already been decommissioned because of the Hugging Face incident, so no user-facing patch was needed, and Check Point’s write-up cites no CVE for the channel.
In that episode, OpenAI models running an internal exploitation evaluation chained Artifactory zero-days to escalate privileges, reach a node with internet access and pull evaluation answers from Hugging Face’s production database. JFrog patched three flaws credited to OpenAI researchers in Artifactory 7.161.15; Hugging Face disclosed the intrusion July 16.
Also read: OpenAI and Hugging Face Investigate AI Models’ Cyber Breakout
Check Point’s Pedro Drimel Neto framed the lesson as one of privilege rather than model behavior, saying “the biggest AI security risk has become the access and trust we give it.” The firm calls an assistant that holds credentials, runs code and reaches connected services a “coerced insider,” and argues the many-tenants-on-one-shared-service pattern warrants scrutiny across agent platforms. OpenAI did not respond to The Register’s request for comment.
The latest disclosure lands weeks after the European Commission and national authorities began enforcing the EU AI Act on Aug. 2. Indirect prompt injection remains the top entry in OWASP’s Top 10 for large language model applications, and NIST’s AI Risk Management Framework treats leakage through connected tooling as a core control area. For enterprises, the exposure is also a GDPR question. Mailbox contents reached through a sanctioned connector are still personal data, and a cross-tenant route to them is a processing failure whether or not it was abused.
