Full Report
Check Point Research said in a report published today that a single instruction planted in a ChatGPT conversation could cause ChatGPT to quietly work for an attacker while answering the user's question as usual. In the company's proof of concept, that hidden work read data from the user's connected Gmail account and passed it to a second ChatGPT account through a hidden channel
Analysis Summary
# Vulnerability: Cross-Account Data Exfiltration via Shared Package Metadata
## CVE Details
- **CVE ID**: Not explicitly assigned in the report (Referenced as a disclosure by Check Point Research).
- **CVSS Score**: N/A (Estimated High/Critical due to silent data exfiltration).
- **CWE**: CWE-284: Improper Access Control; CWE-522: Insufficiently Protected Credentials.
## Affected Systems
- **Products**: OpenAI ChatGPT (Free, Plus, Team, Enterprise).
- **Versions**: Cloud-based service (Resolved server-side).
- **Configurations**: Conversations with "Data Analysis" (Python code execution) enabled; sessions with connected third-party apps (e.g., Gmail) using default "Important actions" permissions.
## Vulnerability Description
The flaw resides in the way ChatGPT’s isolated sandboxes (containers) interact with internal infrastructure. While containers are logically separated, they all communicate with a central **JFrog Artifactory** instance to fetch Python/npm packages.
Check Point discovered that the credentials provided to these containers allowed not only reading but also writing "properties" (metadata) to cached files in the Artifactory instance. Because these properties were not scoped by user account, an attacker could use one conversation to write data to a file's metadata and read it from a different conversation (and different account). This created a "shared clipboard" or covert channel between supposedly isolated environments.
## Exploitation
- **Status**: PoC available (Demonstrated by Check Point Research).
- **Complexity**: Medium (Requires crafting specific instructions to bypass "Thinking" mode UI prompts).
- **Attack Vector**: Network (Indirect via Prompt Injection or malicious Custom GPTs).
## Impact
- **Confidentiality**: **High**. Attackers can silently read Gmail data, chat history, and uploaded files.
- **Integrity**: **Low**. The attack primarily focuses on data theft, though instructions can influence model behavior.
- **Availability**: **None**. No disruption to service reported.
## Remediation
### Patches
- **Vendor Action**: OpenAI has taken the vulnerable internal service (the shared metadata channel) offline. As this is a server-side fix, **no user action/update is required** for the core vulnerability.
### Workarounds
- **Strict Permissions**: Change ChatGPT third-party app settings from "Important actions" to **"Always ask"** to ensure a prompt is triggered for every data read/write.
- **Enterprise Controls**: Admins should disable unnecessary third-party app integrations or restrict them to specific user groups.
## Detection
- **Indicators of Compromise**:
- Unexpected "Talked to [App Name]" labels (e.g., "Talked to Gmail") appearing in chat history for queries that did not explicitly request app interaction.
- Large chunks of Base64 encoded data or unusual Python code involving `requests` to internal package managers in the "Thinking" or "Code" execution blocks.
- **Detection Methods**: Reviewing ChatGPT conversation logs for unexpected tool usage.
## References
- **Check Point Research**: hxxps[://]research[.]checkpoint[.]com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/
- **OpenAI Documentation**: hxxps[://]help[.]openai[.]com/en/articles/11487775-apps-in-chatgpt
- **The Hacker News**: hxxps[://]thehackernews[.]com/2026/09/chatgpt-flaw-let-planted-prompt-send.html