A sneaky backdoor in ChatGPT let hackers read private Gmail data across accounts

Security researchers at Check Point Research discovered a silent channel running directly through an internal package repository used by OpenAI: a vulnerability in the code execution setup of ChatGPT that allowed one isolated user session to send tasks into a completely different user account.

The root cause sat quietly inside an internal instance of JFrog Artifactory, a repository service intended to safely ferry packages to execution containers. While the containers were supposed to be strictly quarantined, every single execution sandbox had read and write access to the exact same repository metadata. It turns out that any sandbox could casually slap custom properties onto shared repository items and read them right back, essentially turning a mundane package delivery system into a shared cross-account clipboard.

Pulling off the breach required shockingly minimal effort from the attacker. A malicious prompt hidden inside a shared link or an innocent-looking custom GPT was enough to set the trap. Once the victim interacted with the poisoned conversation, their instance automatically queried the shared storage pipeline, quietly executed the intruder's task during routine text generation, and shuttled the stolen loot back across the wire.

Because ChatGPT automatically executes read operations on connected third-party tools without bothering the human for confirmation, attackers could silently siphon private correspondence from connected accounts like Gmail, Google Drive, Microsoft Teams, and GitHub. In a live test demonstration, the only visible hint that a user's private emails had just walked out the back door was a tiny, harmless badge in the interface reading 'Talked to Gmail' after the response had already rendered.

Following the disclosure, OpenAI confirmed that the vulnerable internal repository instance has been completely decommissioned.

Granting an AI agent direct keys to the corporate kingdom while relying on software fences made of digital tissue paper is quickly becoming the defining security paradigm of our time. Everyone wants smart assistants wired directly into their private inboxes until they remember that sandbox walls in modern enterprise clouds are often held together by blind trust and shared configuration files.

Source: Check Point Research