Check Point Research published findings on 8 September showing a hidden channel between ChatGPT accounts. An attacker’s session could hand a task to a stranger’s session. The stranger’s ChatGPT carried it out using whatever that person had already connected, and returned the result. In the demonstration, that was the contents of a Gmail inbox.
Gmail was not at fault. No Google credentials were taken. The victim had linked Gmail to ChatGPT through the normal OAuth consent screen, and ChatGPT read the mailbox through that legitimate grant. From Google’s side it was a routine API call from an authorised client.
How it worked
ChatGPT runs code in isolated containers. They cannot reach the internet and cannot talk to each other. They can all reach one internal JFrog Artifactory service that supplies software packages. Check Point found that the read credentials inside every container also allowed writing metadata properties to items in that repository, and reading them back from any other container. Larger payloads were split into chunks. The package cache became a shared clipboard between accounts that were supposed to be walled off.
The attacker plants an instruction where the victim’s session will read it: a pasted prompt, a shared conversation link, or the hidden builder instructions of a custom GPT. On the victim’s next message, ChatGPT answers the visible question and, in the same turn, checks the clipboard, performs the waiting task and writes the result back.
Reach depended on the victim. Check Point lists chat history, uploaded files and any connected app: Gmail, Google Drive, Microsoft Teams, GitHub.
Why the victim saw nothing
ChatGPT’s default connected-app setting approves reads it classifies as low risk without asking. The only trace was a small “Talked to Gmail” label on the answer, logged after the read had completed. It recorded the access. It offered no chance to refuse it.
The same service, twice
Check Point says its proof of concept was working before the activity on the same Artifactory instance that led to the Hugging Face compromise OpenAI has disclosed. Different technique, same shared service. Two separate problems took root in one piece of infrastructure sitting behind every ChatGPT sandbox.
By the time Check Point finished its report the channel had already closed. OpenAI then confirmed the instance had been decommissioned. Check Point makes no claim about whether anyone else used the route.
The mailbox provider’s problem
Mailbox providers built their abuse detection around logins, sessions and sending behaviour. A connected AI assistant sits outside all of that. The consent was real. The token was valid. The read was ordinary. The instruction that triggered it arrived as text the model was never meant to trust, on a platform Google does not operate.
That leaves a question for Google and Microsoft. Can they tell an agent-driven read from a user-driven one, and would they act on the difference? Emailexpert has asked.
Check Point is a security vendor with an AI security product, and it is a member of OpenAI’s Trusted Access for Cyber programme. Its blog post closes with a pitch. The technical findings stand on their own.
