ChatGPT Flaw Leaked Gmail Data to Attacker Accounts

Nobody threat models an artifact cache. It fetches Python wheels and npm tarballs, it is boring, and it lives on the internal network precisely because it is not supposed to matter. Check Point Research spent June 2026 proving that the JFrog Artifactory instance serving ChatGPT's code execution containers was the one thing every sandbox on the platform could touch, and that container credentials could write to it as well as read. The writeup landed in September, reported by The Hacker News.

Key Takeaways

• Check Point Research disclosed a ChatGPT flaw, dated June 2026 and published in early September 2026, that let an attacker's planted instruction read Gmail data out of a different user's session. No CVE was assigned.
• The covert channel ran through an internal JFrog Artifactory package server that every code execution container could reach and whose file properties were not segregated by account.
• Credentials granted for reading also authorized property writes, so a value written from one account's container came back readable from another account's container moments later.
• ChatGPT's Thinking mode ran two streams at once: one answered the victim's question, the second polled the attacker's hidden mailbox and returned results base64 encoded across metadata properties.
• OpenAI confirmed the finding and decommissioned the internal service. No user facing patch shipped, because the defect sat in infrastructure rather than in the model.

What Did Check Point Actually Find?

Check Point found a cross account side channel, not a model jailbreak. The attacker plants a hidden instruction where the victim's session will read it: a prompt pasted into a chat, a shared conversation link, or the builder instructions behind a custom GPT. Nothing fires until the victim sends an ordinary message. ChatGPT's Thinking mode then splits its work, and one stream starts checking an attacker controlled drop point for jobs, running them with whatever tools the session already holds, and posting results back. The full mechanism is on the Check Point Research blog.

The proof of concept pulled Gmail account data through connected apps, conversation histories, and files loaded into the session. Real scope tracks whatever that session could already reach.

Most coverage filed this under prompt injection. Prompt injection was only the ignition. The actual defect was an authorization scope on file metadata inside a build server, and that distinction decides who fixes it: not the safety team tuning refusals, the platform team that wrote the Artifactory policy.

How Did a Package Server Become a Covert Channel?

Because Artifactory lets a client attach named properties to a stored item and read them back, and the credentials containers held for fetching packages also authorized those writes, with no separation by account. Check Point called the result a shared clipboard between containers that were supposed to be walled off from each other.

The isolation model is the instructive part for anyone building sandboxes. ChatGPT's containers cannot reach the public internet, which is the property everybody tests. They can reach an allowlisted internal package mirror, which is the exception nobody counts as network access. Isolation was designed against exfiltration to the outside and quietly assumed no shared writable state on the inside. Any store two tenants can both write to and both read from is a channel, whatever it was built for.

Bandwidth never mattered. Properties hold small strings, so the payload gets base64 encoded, split across several of them, and reassembled at the other end. Polling one property in a loop turns a dead drop into an interactive session with a command channel and a response channel. This is textbook OWASP LLM01 prompt injection chained to plain old broken access control, and the second half is the half that made it work.

Carry the metadata detail into your own review. Properties are not file content, so they sit outside data classification, outside DLP inspection, and outside the audit trail covering artifact uploads.

Why Was Gmail the Prize?

Because the Gmail connector reads without asking. ChatGPT's connected apps default to a permission tier OpenAI calls Important actions, which lets reads happen automatically and only interrupts before actions that reach outside ChatGPT, expose sensitive information, or are hard to undo. Reading your mail is none of those, by that definition. OpenAI documents the tiers and the stricter Always ask setting in its guide to managing app permissions in ChatGPT.

The victim saw a small "Talked to Gmail" label on the answer, written after the read had already completed. That is a receipt, not a prompt. Enterprise and Education workspaces start with apps disabled; Business plans enable them by default.

The compound risk is the point. Prompt injection with no connectors attached is an embarrassing chatbot. A broad connector scope with no injection path is a normal product feature. Put the two together and a stranger's text gets to spend your OAuth grant, the same arithmetic that showed up when AI browsers followed hidden orders buried inside email.

What This Means for Your Inbox

Your mailbox is the densest thing any assistant can reach. Password reset links, invoices with bank details, contracts, medical appointments, the full record of who you talk to. Connect it to an agent and its security stops being Google's alone; it becomes the weakest link across Gmail's controls, the connector's scope, and the agent vendor's internal network architecture. Check Point's finding sat in that third category, the one you cannot inspect, test or configure.

This is the fifth incident in 2026 we have covered where an assistant with mailbox access was made to read or leak mail for somebody else, after May's Gemini summarization injection, the Copilot CoSnitch flaw, the Claude for Chrome extension flaw, and July's AI browser hijacks. Four vendors, four unrelated bugs, one repeated shape.

Nothing about the Artifactory trick is specific to Gmail, either. The exfiltration primitive was a shared internal store, and the mail connector was simply the richest thing plugged into the session. Any assistant that reads Outlook, Yahoo Mail or a Workspace tenant through an OAuth grant carries the same downstream exposure the moment an upstream isolation assumption fails.

What Should You Do Now?

Nothing to patch on your side, because OpenAI removed the service rather than shipping an update. What is left is scope reduction on your accounts and a hard look at your own sandboxes. OpenAI's connectors documentation covers the settings behind the first two items.

• Switch connectors to Always ask. The default trades a confirmation click for silent reads. Reverse that trade on anything touching mail, files or calendars.
• Audit what is actually connected. Most people attach Gmail once for a single task and leave the grant live for months. Business tenants also ship with apps enabled, so confirm which ones are on and who turned them on.
• Treat every allowlisted internal service as an isolation boundary. Package mirrors, artifact caches, telemetry collectors and DNS resolvers are all reachable from a sandbox that has no internet, and all of them carry state.
• Verify that read only credentials are read only. Intent is not enforcement. Check the permission target on the token, not the name of the role.
• Segregate and log metadata the way you do content. Properties, tags and labels need the same tenant scoping and audit trail as the artifacts they hang off.

Looking Ahead

This is the second time in six months Check Point has found a shared internal service at OpenAI acting as an unintended communication layer, after the DNS based channel that let attackers pull conversations out of ChatGPT without a trace in March 2026. Same sentence, different service. Two data points make a pattern worth naming: sandbox isolation on AI platforms is enforced at the egress firewall and nowhere else.

The disclosure shape is the uncomfortable part for defenders. No CVE, no version number, nothing to feed into vulnerability management. You cannot ask which build of ChatGPT your company runs, you cannot scan for it, and you learn the exposure window only if the vendor volunteers it. Check Point dated the research to June and published in September; how long the channel had been open before that is not on the record.

Assume the next one exists and price your connector scopes accordingly. The permission you never granted is the only one nobody else's prompt can spend.