ChatGPT: Hidden Prompt Could Siphon Gmail Data

A vulnerability in ChatGPT allowed data theft via internal servers. OpenAI has deactivated the affected background service.

Security experts from Check Point Research have uncovered a vulnerability in ChatGPT through which attackers could steal confidential data such as Gmail content, chat histories, or uploaded files using a crafted prompt. The data was transferred unnoticed in the background to an external ChatGPT account.

Infiltration and covert execution

The malicious command could enter a conversation in three ways: through manual insertion by the user, upon opening a shared chat link, or covertly in the system instructions of a Custom GPT.

As soon as a normal message was entered, ChatGPT executed two parallel processes in the so-called Thinking Mode: While the user was shown the usual response, the model checked the attacker’s instructions in the background, accessed the Gmail account via linked interfaces, and exfiltrated the information. For users, only the small label “Talked to Gmail” was visible, as standard permissions from OpenAI allow read access without explicit confirmation.

Technical background and remediation

• Covert communication channel: ChatGPT uses isolated containers for code execution. Although direct external network connections or connections between different containers are blocked, all instances accessed a shared internal JFrog Artifactory instance for software packages.
• Metadata as a clipboard: Information could be exchanged across accounts via write permissions on file properties in Artifactory. The package service thus acted as an unintended clipboard between actually separated environments.
• Remediation by OpenAI: Check Point reported the discovery to OpenAI. The company immediately took the affected internal background service offline. A client-side update for end users is not required.

(Editorial Team)