Back Cybersecuritynews

ChatGPT Vulnerability Let Attackers Silently Exfiltrate User Prompts and Other Sensitive Data

Cybersecuritynews •Abinaya • March 31, 2026

Users routinely trust AI assistants with highly sensitive information, including medical records, financial documents, and proprietary business code. Check Point Research recently disclosed a critical vulnerability in ChatGPT’s architecture that allowed attackers to extract this exact type of user data silently. By abusing a covert outbound channel in ChatGPT’s isolated code execution environment, attackers could […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical ChatGPT Data Leak Exploited via DNS Channel A recently discovered vulnerability in ChatGPT allowed attackers to exfiltrate sensitive user data through a covert DNS channel. Researchers from Check Point found that a single malicious prompt could activate this hidden exfiltration method, bypassing OpenAI's safeguards. The flaw enabled the silent extraction of user messages, uploaded documents, and contextual data without user awareness. OpenAI patched the vulnerability on February 20, 2026, following responsible disclosure, and stated there was no evidence of active exploitation. However, the incident raises concerns about the security of AI systems handling sensitive information. The vulnerability particularly affects custom GPTs, which could be manipulated to leak data. The implications are significant for industries dealing with regulated data, such as healthcare and finance. Organizations are advised to implement layered security measures to mitigate risks. 13 sources 68

Extracted Entities

ChatGPT Vulnerability Let Attackers Silently Exfiltrate User Prompts and Other Sensitive Data

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (2)