ChatGPT’s New Calendar Integration Can Be Abused to Steal Emails

According to EdisonWatch, a new ChatGPT calendar integration can be abused to execute an attacker’s commands and even steal a user’s emails. The researchers analysed OpenAI’s Model Context Protocol tool support, which lets the gen-AI service interact with a user’s email, calendar and other services, and demonstrated how an attacker could exfiltrate sensitive information from a target’s inbox simply by knowing the target’s email address.

The attack starts with a specially crafted calendar invitation containing a jailbreak prompt that instructs ChatGPT to search for and send sensitive data to an attacker’s specified email address, with the victim not needing to accept the invite to trigger the commands. The deception can be triggered when the victim asks ChatGPT to check their calendar or plan the day, rather than through calendar acceptance alone. EdisonWatch has released version 1 of an open source solution designed to mitigate common AI attacks and help secure integrations.