ChatGPT flaw let a hidden prompt quietly siphon a victim's Gmail data to an attacker

Check Point Research disclosed on September 8 a vulnerability in ChatGPT that allowed an attacker to exfiltrate data from a victim's connected Gmail account without the victim seeing any sign of it happening. The flaw exploited ChatGPT's "Thinking mode," which can run two work streams at once: OpenAI confirmed the issue and took the internal service behind the exploit offline, closing the hole server-side with no update required from users.

The attack began with a hidden instruction planted somewhere the victim would encounter it — a pasted prompt, a shared conversation, or the custom instructions field of a third-party GPT. Once a victim's ordinary message triggered the compromised session, ChatGPT produced its normal, visible answer while a second, covert task ran in parallel and was deliberately kept out of that visible response. Researchers found the mechanism relied on a hidden mailbox: the attacker sent tasks into the compromised session through this channel, the session executed them using whatever external tools and connected apps the victim had authorized, and the results were quietly reported back the same way.

Why connected apps made this so effective

The exploit specifically targeted ChatGPT's connected-apps integration, which by default enables an "Important actions" permission that lets ChatGPT read from a linked app without prompting the user first. Users are typically only interrupted for confirmation when ChatGPT is about to take a consequential external action — sending an email, for instance — not when it is merely reading data. That asymmetry is exactly what the attack abused: reading a victim's Gmail inbox and forwarding its contents required no visible permission prompt, no unusual notification, and no indication in the chat transcript that anything beyond the visible conversation had occurred.

OpenAI's fix took the form of taking the shared internal service offline rather than shipping a client update, meaning the vulnerability is now closed for all users regardless of which ChatGPT client or version they run. No CVE has been assigned, consistent with how OpenAI has handled several previous ChatGPT security disclosures — fixes ship quickly and quietly, with technical detail coming primarily from the researchers who found the bug rather than from a public OpenAI advisory.

A structural problem, not just a bug

What makes this disclosure significant beyond the specific fix is what it reveals about the architecture underneath conversational AI agents with tool access. Check Point's researchers describe the root cause as a shared internal service becoming an "unintended communication layer" between what should have been isolated user sessions — effectively a covert channel that let one compromised conversation talk to another without either user's awareness. As AI assistants are increasingly wired into email, calendars, file storage, and other high-value personal data through connected-app integrations, the attack surface isn't just the model's own outputs anymore; it's every piece of shared infrastructure that different users' sessions happen to touch.

For anyone using ChatGPT's connected apps with Gmail, Google Drive, or similar integrations, the immediate risk from this specific flaw is closed. The longer-term takeaway is less comfortable: default "read without prompting" permissions on connected apps trade convenience for exactly the kind of silent-exfiltration risk this incident demonstrated. Users and enterprise administrators managing ChatGPT's app-connector permissions should treat read-access defaults with the same scrutiny normally reserved for write or send permissions, since this incident shows read access alone was sufficient to move sensitive data out of a victim's account undetected.

As first reported by The Hacker News, citing research from Check Point Research published September 8, 2026.