CHECK Point Research disclosed a critical flaw in ChatGPT whereby a single instruction planted into a conversation could cause the model to perform attacker‑driven tasks in the background while continuing to answer the user’s question. In the PoC, the hidden task read data from the user’s connected Gmail account and transmitted it to another ChatGPT account via a concealed channel, with the user’s visible reply remaining uninformed. The same channel could also copy chat histories and files from the session.
The extent of what could be stolen depended on what the current session already had access to, including data, tools, connected apps, and permissions.
The mechanism required the instruction to be present in the conversation beforehand and could be introduced via a pasted prompt, a shared ChatGPT thread, or a custom GPT builder instruction. Once triggered, ChatGPT supposedly ran two streams of work in a single turn: it answered the user while simultaneously surveying a hidden mailbox for attacker tasks and executing them within the user’s session, with the illicit activity hidden from the user. The only visible sign was a small “Talked to Gmail” label.
OpenAI confirmed the internal service behind the channel was taken offline, and no user action or software update was required. Check Point noted that default permissions in certain workspaces allowed apps to read data without prompting, underscoring the risk in tightly coupled app integrations.