Thehackernews ChatGPT Vulnerability Enables Gmail Data Theft via Hidden Channel
Article Content
- •A vulnerability in ChatGPT allows attackers to exfiltrate Gmail data from victims without their knowledge.
- •The exploit requires a hidden instruction to be present in the victim's ChatGPT session.
- •OpenAI has decommissioned the internal service used for this exploit following its disclosure.
Check Point Research revealed a vulnerability in ChatGPT that allows attackers to exfiltrate data from a victim's connected Gmail account without their knowledge. The exploit involves a hidden cross-account communication channel that can be activated by a planted instruction in a ChatGPT conversation. This instruction can be delivered through various methods, including a pasted prompt, a shared conversation link, or a custom GPT. Once activated, the attacker can access the victim's Gmail data and other connected services, with the victim unaware of any unusual activity. The flaw lies in the infrastructure of ChatGPT's code-execution containers, which, while isolated, can communicate through a shared internal service. OpenAI has confirmed that this internal service has been taken offline following the discovery. No CVE has been assigned to this issue, and there are currently no patches available for users to install.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track Check Point Research in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…