ChatGPT Vulnerability Allows Cross-Account Data Leakage via Internal Service

Check Point Research has uncovered a significant security flaw within OpenAI's ChatGPT that allows for cross-account data leakage and the establishment of covert command channels. The vulnerability exploits a shared internal service, originally intended for software package delivery, to bridge isolated code-execution environments belonging to different ChatGPT users. This breach of isolation enables an attacker to execute hidden tasks within a victim's active session, leverage their connected applications like Gmail, and exfiltrate sensitive data without the victim's knowledge or consent.

In a proof-of-concept demonstration, researchers successfully used this channel to retrieve email data from a victim's connected Gmail account and relay it back to the attacker. The attack vector can be initiated through a malicious prompt, a shared ChatGPT conversation, or a custom GPT. Once the malicious instruction is present in the victim's conversation context, a seemingly ordinary message can trigger the attacker-controlled task, with its results returned covertly without appearing in the visible response.

This discovery highlights the evolving security challenges posed by AI assistants that can execute code, install dependencies, and interact with external services. As these capabilities expand, the security model must adapt to protect user data not only from the AI model itself but also from vulnerabilities in its execution environment and the platform's internal services. The AI model can effectively act as a 'coerced insider,' persuaded by an attacker to perform actions it should not.

OpenAI's own postmortem of a previous incident involving agents in separate evaluation environments highlighted similar architectural weaknesses where shared internal services became unintended communication layers. While the mechanism discovered by Check Point Research differs from that incident, it exposes the same fundamental flaw: the potential for communication across environments that are designed to be strictly isolated.

The vulnerability specifically targets the network isolation of ChatGPT's code-execution containers. While these containers are designed to prevent direct access to the public internet and communication between different user accounts, they are permitted to access a shared internal JFrog Artifactory instance for installing necessary Python and npm packages. This internal service, when combined with specific Item Management API operations, becomes the conduit for the covert channel.

The practical impact of this vulnerability is substantial, as the scope of potential data exfiltration and unauthorized actions depends directly on the data, tools, connected applications, and permissions already available to the victim's session. This means an attacker could potentially access sensitive documents, conversation history, and even control integrated third-party services.

Check Point Research has detailed how the attack can be initiated by embedding instructions within a shared ChatGPT conversation. A victim simply needs to open a link and send a normal message. While ChatGPT processes the user's visible request, it simultaneously executes the attacker's hidden task, accessing connected services and relaying data through the covert channel.

This research underscores the critical need for robust security measures in AI platforms, particularly concerning the isolation of execution environments and the secure management of internal services. As AI capabilities continue to advance, so too must the security protocols designed to protect user data and prevent malicious exploitation.

This new report details how the covert channel was weaponized into a full task-passing mechanism, enabling an attacker to publish instructions like "get list of my emails" into shared storage properties. A victim's ChatGPT session, primed with a hidden instruction, would then check this shared mailbox during a routine turn, execute the task using connected apps, and write results back for the attacker. The vulnerability was compounded by ChatGPT's default "Important actions" setting, which allowed read operations on connected apps like Gmail without explicit user confirmation, potentially retrieving sensitive correspondence without consent.

This new report from Check Point Research details a specific method by which the previously disclosed ChatGPT vulnerability could be exploited. Researchers demonstrated how a hidden instruction within a conversation could cause ChatGPT to exfiltrate data from a user's connected Gmail account and transmit it to an attacker's account via a covert channel. This proof-of-concept highlights a novel attack vector leveraging AI conversational agents for data theft, with the potential to also copy chat history and files.