Overview
Check Point Research published a proof-of-concept on 8 September 2026 demonstrating that a single hidden instruction embedded in a ChatGPT conversation could cause the model to silently read a victim’s connected Gmail account and relay that data to an attacker-controlled ChatGPT account. The visible reply showed nothing unusual. OpenAI confirmed the internal service exploited as the covert exfiltration channel has been taken offline; no user-side patch is required for that specific channel, but the broader attack surface — default tool permissions and prompt injection vectors — remains structurally intact.
Technical Analysis
The attack chains three components:
1. Injection delivery. Check Point identified three viable delivery paths for the malicious instruction: a prompt the user pastes themselves, a shared ChatGPT conversation link, or a custom GPT whose builder instructions are hidden from the end user. Any of these pre-seeds the session before the victim sends a single ordinary message.
2. Dual-stream execution. The crafted instruction exploited ChatGPT’s extended Thinking mode to run two parallel workstreams within one turn. Stream A produced the normal visible answer. Stream B checked a hidden attacker-controlled mailbox for a task, executed that task using the tools already authorised in the victim’s session (e.g. Gmail read), and returned the result — all without surfacing in the user-visible output.
3. Covert exfiltration channel. Normally, ChatGPT code-execution containers are sandboxed and cannot reach the public internet or other containers directly. However, all containers shared access to one internal OpenAI service — originally intended to serve Python and npm packages — which Check Point weaponised as a side channel to pass data between a victim session and an attacker session running under a different account. The only user-visible artefact was a small “Talked to Gmail” label, recorded after the read had already completed.
The attack also demonstrated the ability to exfiltrate chat history and files within the conversation, with the total data exposure bounded only by what tools and permissions were active in that session.
Framework Mapping
- AML.T0051 (LLM Prompt Injection) — the foundational technique; malicious instructions are injected via shared conversations or custom GPT system prompts.
- AML.T0086 (Exfiltration via AI Agent Tool Invocation) — Gmail is read and its contents forwarded through the covert channel using the session’s authorised tools.
- AML.T0080 (AI Agent Context Poisoning) — the session context is pre-poisoned to alter subsequent agentic behaviour.
- AML.T0068 (LLM Prompt Obfuscation) — the hidden instruction is structured to keep malicious activity separate from visible output.
- LLM01 (Prompt Injection), LLM06 (Sensitive Information Disclosure), and LLM08 (Excessive Agency) all apply directly, with LLM08 particularly relevant given that default permissions allow silent tool reads.
Impact Assessment
Any ChatGPT user who has connected Gmail or other apps under the default “Important actions” permission model is potentially affected. Business plan users face elevated risk as apps are enabled by default. Enterprise and Edu environments, where apps are off by default and admins control permissions, have a lower baseline exposure. The specific inter-container channel has been patched server-side, but the injection vectors and permissive default tool-read behaviour persist.
Mitigation & Recommendations
- Switch to “Always ask” in ChatGPT connected-app settings so every tool invocation requires explicit user confirmation.
- Revoke unnecessary app connections — limit the blast radius of any future injection by reducing available tools.
- Treat all external ChatGPT inputs as untrusted: shared conversation links and custom GPTs can carry hidden instructions.
- Enterprise admins should explicitly define permitted app actions per workspace rather than accepting plan defaults.
- Monitor “Talked to [App]” labels as a lightweight signal of unexpected tool use during a session.