Cases › security breach › LR-2026-0730
ChatGPT flaw let attackers read victims' Gmail through hidden channel
Confirmed Why: Check Point Research research · Check Point Research · 1 independent report
Status: no action reported
No source states: loss or records, developer and model, could do, deployer, industry.
Severity moderate: others' data was touched (the victim's Gmail in the demonstration) and the reach is bounded by what the victim's session was already authorized to access, per the source
ChatGPT's code execution containers could reach an internal JFrog Artifactory package delivery service that was meant to keep containers from different accounts isolated. Check Point Research found that this service let any container write and read shared metadata, creating a hidden two-way channel between separate ChatGPT sessions under different accounts. A planted instruction in a malicious prompt, shared conversation or custom GPT could make a victim's session pick up a task from another account and carry it out with the victim's own permissions. In a live demonstration, the victim's connected Gmail data was retrieved and delivered to the attacker's session within one ordinary turn. The victim saw only a normal answer. Check Point Research disclosed the finding to OpenAI, which confirmed the specific Artifactory instance involved had been decommissioned.
What happened
What was done
No source states an action or fix.
Risks
Primary50 incidents
Rising: 6 vs 2.8 a week
Read from the sources; not yet reviewed by a person.
Controls
HarnessDid not exist Confirmation after untrusted input
Did not exist Stop control
Not effective Segmentation of agent components
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessChatGPT code execution containersAgent framework vendor
Other controls for this risk at this layer, not mentioned in the sources: Outside content treated as data, not instructions, Prompt-injection detection, Validation of tool inputs and outputs, Tool allow-list.
L3 · ApplicationDeployer not namedDeployer
Other controls for this risk at this layer, not mentioned in the sources: Human approval for high-impact actions, Least-privilege access for the agent, Alerts on unusual tool use.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Confirmation after untrusted input | L2 Harness | Did not exist |
| Stop control | L2 Harness | Did not exist |
| Tool allow-list | L2 Harness | Not stated in sources |
| Outside content treated as data, not instructions | L2 Harness | Not stated in sources |
| Prompt-injection detection | L2 Harness | Not stated in sources |
| Validation of tool inputs and outputs | L2 Harness | Not stated in sources |
| Segmentation of agent components | L3 Application | Not effective |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Human approval for high-impact actions | L3 Application | Not stated in sources |
| Alerts on unusual tool use | L3 Application | Not stated in sources |
Similar incidents
Evidence
- What set it off hidden instructions in its input
No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what was done.
Show the full account: 1 items from the primary sources
What happened, in order
Not dated in the sources:
- Check Point Research's proof of concept was already working before a separate chain of activity on the same Artifactory instance led into the Hugging Face compromise.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
No source gives the date the incident occurred or the date of disclosure to OpenAI; the 2026-09-08 date is the publication date of the Check Point blog, used as the timeline date only. The attack was a research proof of concept; the source does not say it was exploited in the wild. Control F1 is marked held because the log label recorded the read, though only after it happened. The Hugging Face compromise is mentioned but not described, so it is not recorded as a separate event.
LR-2026-0730 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON