Security researchers at Check Point discovered a flaw in ChatGPT that let a single hidden instruction — embedded inside a document the user asked ChatGPT to read — silently access the victim’s connected Gmail account and relay the contents to an attacker. The technique is a prompt injection: when ChatGPT’s Thinking mode processes a document containing a hidden command, it can run two parallel threads in the same conversation — one generating the visible response the user sees, and one executing a hidden task. In this case, the planted instruction told the model to query Gmail through ChatGPT’s connected-apps feature, collect messages, and transmit them without the user ever being prompted or seeing the operation occur. The only visible trace was a small “Talked to Gmail” label above the response — a notification that appeared after the read had already happened.
The exfiltration path ran through an unexpected internal channel. Every ChatGPT code-execution container is allowed to contact an internal JFrog Artifactory server to download Python and npm packages. Check Point found that containers running under completely separate user accounts could read and write named properties on files stored in that service — no credential theft or privilege escalation required, because the access credentials were already available in each container’s environment variables. This turned the internal package cache into a shared clipboard between sessions that were never supposed to communicate. An attacker’s container could leave an instruction embedded in an Artifactory file property; a victim’s container in a different session would retrieve that property and execute the hidden command. Check Point disclosed the finding to OpenAI, which confirmed the internal service has been taken offline. There is no update for users to install — the attack channel no longer exists.