ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account

Summary: Check Point Research reported that a single instruction planted in a ChatGPT conversation could make ChatGPT read data from a user's connected Gmail account and pass it to a second ChatGPT account through a hidden channel, while the visible reply said nothing about it. The instruction could arrive via a pasted prompt, a shared conversation, or a custom GPT's builder instructions, and the channel ran through an internal JFrog Artifactory instance whose file properties were not separated by account.
What's compelling: The credentials a ChatGPT container held for read access were also enough to write the properties used as the channel, so no separate secret or privilege escalation was needed to move data between accounts meant to stay isolated. Check Point dated its work to June 2026 and did not say when the channel stopped working, so the report does not show how long it was open.

Read the original at The Hacker News ↗