{"schema_version":"0.10.0","id":"LR-2026-0730","record_version":1,"title":"ChatGPT flaw let attackers read victims' Gmail through hidden channel","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":5.76,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"Check Point Research research","original_document":{"url":"https://blog.checkpoint.com/research/chatgpt-let-attackers-read-victims-gmail-through-a-hidden-channel-between-accounts/","organisation":"Check Point Research","role":"researcher"},"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"Check Point Research research"}]},"sources_hash":"34656d8826695a308c28f6e481d154b516d6ec2d0960c16a097428680bb60c44"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"ChatGPT code execution containers","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-08","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"ChatGPT's code execution containers could reach an internal JFrog Artifactory package delivery service that was meant to keep containers from different accounts isolated. Check Point Research found that this service let any container write and read shared metadata, creating a hidden two-way channel between separate ChatGPT sessions under different accounts. A planted instruction in a malicious prompt, shared conversation or custom GPT could make a victim's session pick up a task from another account and carry it out with the victim's own permissions. In a live demonstration, the victim's connected Gmail data was retrieved and delivered to the attacker's session within one ordinary turn. The victim saw only a normal answer. Check Point Research disclosed the finding to OpenAI, which confirmed the specific Artifactory instance involved had been decommissioned.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"Shared internal Artifactory item-property feature let any container write and read data that should have been isolated per account","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":"Malicious prompt pasted into a chat, a shared conversation link, or a custom GPT with a hidden instruction","time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK01","secondary_risks":["RK04","RK03"],"control_chain":[{"layer":"L3","party":"deployer","party_name":null,"control_id":"E4","outcome":"failed","reason":null,"quote":"The service was meant to isolate containers from each other, but it let any container write and read shared metadata that isolated accounts should never have been able to share","source_index":0,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"B2","outcome":"missing","reason":null,"quote":"ChatGPT’s default connected app setting automatically approves read actions it considers low risk, without a separate confirmation step.","source_index":0,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"B3","outcome":"missing","reason":null,"quote":"It recorded what occurred. It did not give the victim a chance to stop it.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate: others' data was touched (the victim's Gmail in the demonstration) and the reach is bounded by what the victim's session was already authorized to access, per the source","harm_class":["privacy"],"affected_description":"One victim's connected Gmail email data, retrieved in a live Check Point Research demonstration","protected_class_involved":null,"data_categories_exposed":["email"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://blog.checkpoint.com/research/chatgpt-let-attackers-read-victims-gmail-through-a-hidden-channel-between-accounts/","publisher":"Check Point Blog","date":"2026-09-08","type":"press","title":"ChatGPT Let Attackers Read Victims’ Gmail Through a Hidden Channel Between Accounts - Check Point Blog","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.harness":"C","event.agent_involved":"C","event.failure_class":"C","event.trigger":"C","event.root_cause_detail":"C","event.input_provenance":"C","impact.harm_class":"C","impact.data_categories_exposed":"C","impact.affected_description":"C","event.incident_class":"D","impact.severity_because":"D","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"The channel ran through an internal package delivery service (JFrog Artifactory) that ChatGPT’s code execution containers were allowed to reach."}],"event.agent_involved":[{"source_index":0,"quote":"A single planted instruction, delivered through a malicious prompt, a shared conversation, or a custom GPT, was enough to get a victim’s session checking that same storage during its next ordinary reply."}],"event.failure_class":[{"source_index":0,"quote":"A single planted instruction, delivered through a malicious prompt, a shared conversation, or a custom GPT, was enough to get a victim’s session checking that same storage during its next ordinary reply."}],"event.trigger":[{"source_index":0,"quote":"A single planted instruction, delivered through a malicious prompt, a shared conversation, or a custom GPT, was enough to get a victim’s session checking that same storage during its next ordinary reply."}],"event.root_cause_detail":[{"source_index":0,"quote":"Check Point Research found that the service exposed an item management feature letting any container attach text or binary properties to a repository item, and letting any container read those properties back."}],"event.input_provenance":[{"source_index":0,"quote":"Delivery required almost nothing from the victim: a malicious prompt pasted into a chat, a shared conversation link, or a custom GPT with a hidden instruction were all enough to activate it"}],"impact.harm_class":[{"source_index":0,"quote":"In Check Point Research’s demonstration, ChatGPT retrieved the victim’s email data through their connected Gmail account and delivered it to the attacker’s session, all within a single ordinary turn."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"In Check Point Research’s demonstration, ChatGPT retrieved the victim’s email data through their connected Gmail account and delivered it to the attacker’s session, all within a single ordinary turn."}],"impact.affected_description":[{"source_index":0,"quote":"In Check Point Research’s demonstration, ChatGPT retrieved the victim’s email data through their connected Gmail account and delivered it to the attacker’s session, all within a single ordinary turn."}],"event.incident_class":[{"source_index":0,"quote":"Check Point Research discovered a covert, two way channel between the code execution containers of two separate ChatGPT conversations running under different accounts."}],"impact.severity_because":[{"source_index":0,"quote":"The reach of the attack depended entirely on what the victim’s own session was already authorized to access."}],"impact.severity":[{"source_index":0,"quote":"The reach of the attack depended entirely on what the victim’s own session was already authorized to access."}],"event.control_chain":[{"source_index":0,"quote":"The service was meant to isolate containers from each other, but it let any container write and read shared metadata that isolated accounts should never have been able to share"},{"source_index":0,"quote":"ChatGPT’s default connected app setting automatically approves read actions it considers low risk, without a separate confirmation step."},{"source_index":0,"quote":"It recorded what occurred. It did not give the victim a chance to stop it."}],"event.summary":[{"source_index":0,"quote":"The service was meant to isolate containers from each other, but it let any container write and read shared metadata that isolated accounts should never have been able to share"},{"source_index":0,"quote":"A single planted instruction, delivered through a malicious prompt, a shared conversation, or a custom GPT, was enough to get a victim’s session checking that same storage during its next ordinary reply."},{"source_index":0,"quote":"In Check Point Research’s demonstration, ChatGPT retrieved the victim’s email data through their connected Gmail account and delivered it to the attacker’s session, all within a single ordinary turn."},{"source_index":0,"quote":"The victim sent one ordinary message, saw a normal answer, and never knew their assistant had also been working for someone else during that same turn"}]},"notes_on_gaps":"No source gives the date the incident occurred or the date of disclosure to OpenAI; the 2026-09-08 date is the publication date of the Check Point blog, used as the timeline date only. The model name, version and lifecycle stage are not stated. Deployment context was not set because the source describes live ChatGPT but does not say whether this was production use. Autonomy level is not stated. The attack was a research proof of concept; the source does not say it was exploited in the wild. Severity moderate is my judgement: the victim's data was touched and the reach is stated as bounded by the victim's own authorizations, with no stated count of affected parties. Failure class injection_triggered and trigger prompt_injection are my judgement from the planted-instruction description. Root cause infrastructure is my judgement from the Artifactory isolation gap. Control F1 is marked held because the log label recorded the read, though only after it happened. Decommissioning is the only remediation stated, and the source does not say when it occurred. The Hugging Face compromise is mentioned but not described, so it is not recorded as a separate event. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (Check Point Research research)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"A victim's ChatGPT session, when a task was waiting in shared storage, carried it out with the victim's own permissions and answered the real question as usual.","quote":"ChatGPT would carry it out using whatever the victim’s own session already had permission to do, write the result back to the shared storage, and answer the victim’s real question as if nothing else had happened.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"An internal package delivery service meant to isolate containers let any container write and read shared metadata, creating a shared channel between accounts.","quote":"The service was meant to isolate containers from each other, but it let any container write and read shared metadata that isolated accounts should never have been able to share","source_index":0,"grade":"C"},{"step":"reached","text":"In a live demonstration, the victim's connected Gmail data was retrieved and delivered to the other account's session within one ordinary turn.","quote":"In Check Point Research’s demonstration, ChatGPT retrieved the victim’s email data through their connected Gmail account and delivered it to the attacker’s session, all within a single ordinary turn.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://blog.checkpoint.com/research/chatgpt-let-attackers-read-victims-gmail-through-a-hidden-channel-between-accounts/"]},"analysis":{"sections":{"timeline":[{"text":"Check Point Research's proof of concept was already working before a separate chain of activity on the same Artifactory instance led into the Hugging Face compromise.","quote":"Check Point Research’s proof of concept was already working before a separate chain of activity on that same Artifactory instance eventually led into the Hugging Face compromise that OpenAI has since disclosed publicly","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://blog.checkpoint.com/research/chatgpt-let-attackers-read-victims-gmail-through-a-hidden-channel-between-accounts/"]}}