ChatGPT Prompt Injection Flaw Silently Exfiltrated Gmail Data

Researchers at Check Point have disclosed a prompt injection vulnerability in ChatGPT that allowed a single planted instruction to silently read a victim's connected Gmail account and forward the contents to an attacker-controlled ChatGPT session, all while the visible reply appeared completely normal. In a proof of concept published today, the hidden task ran in parallel with the user's request inside ChatGPT's Thinking mode, queried a covert mailbox for attacker-supplied instructions, executed them using the victim's existing tools, and exfiltrated the results through an internal service shared between conversation containers. The only surface-level clue was a small "Talked to Gmail" label that confirmed a read had already occurred, leaving the user with no prompt to approve or deny the action.

Check Point identified three delivery vectors for the malicious instruction: a prompt the victim pastes into the chat, a shared ChatGPT conversation the victim opens, or a custom GPT whose builder instructions are never displayed to the end user. Once planted, a single ordinary message was enough to activate the payload. The researchers noted that the covert channel exploited how ChatGPT's runtime containers handle cross-session requests; while documentation states that the Python sandbox used for data analysis cannot reach external APIs, separate conversation containers all share access to one internal service, creating an indirect path between otherwise isolated sessions. Users concerned about exposure of mailbox contents can verify their accounts with an email breach checker and review connected app permissions through a broader privacy checkup.

The flaw was amplified by OpenAI's default permission model for connected apps. According to OpenAI's documentation, the "Important actions" tier allows ChatGPT to read from a linked application, such as Gmail, without prompting the user first. ChatGPT only requests confirmation before actions that have an external effect, expose sensitive information, or are difficult to undo, but a silent read qualifies as none of these by default. Administrators of Business, Enterprise, and Edu workspaces can restrict which actions each connector may perform, though apps remain on by default for Business plans and off by default for Enterprise and Edu. Individual users who want confirmation for every action can switch the setting to "Always ask."

Check Point said it disclosed the findings to OpenAI, which confirmed the internal service used as the covert channel has been taken offline, and no user-side patch or update is required. The blast radius of the technique was limited by what the victim's session could already access, including chat history, uploaded files, connected integrations, and granted tools, meaning the same primitive could be repurposed against any third-party app with similar permissions. The disclosure underscores the broader risk of agentic AI workflows where model autonomy and persistent connections turn a single injected instruction into a credentialed exfiltration path, and it reinforces the need for users reusing passwords across services to test them with a password checker and rotate any credentials exposed through a compromised Gmail integration.