Singapore – A vulnerability in ChatGPT allowed one user’s account to send tasks to a separate, unrelated account without either user’s visible conversation showing any sign of it, according to research published by Check Point Research (CPR).
The issue stemmed from an internal infrastructure component that was not designed to carry user data, which undermined the isolation intended to keep separate accounts from interacting with one another.
In a demonstration, an attacker’s session issued an instruction that caused a victim’s session to retrieve data from the victim’s connected email account. During the exchange, the victim’s visible conversation showed a single message and a reply that appeared unrelated to the additional activity taking place in the background, CPR said.
According to the study, the channel ran through an internal package delivery service called JFrog Artifactory, which ChatGPT’s code execution containers were permitted to reach when installing software packages. The service was intended to keep containers isolated from one another, but CPR said it found that any container could write and read shared metadata that separate accounts should not have been able to access.
The study said that the Artifactory instance included an item management feature that allowed any container to attach text or binary properties to a repository item and to read those properties back. Reader credentials already present inside every container were sufficient to use both functions, which allowed the service’s metadata to be used as a channel between containers that were intended to remain separate.
To test the issue, researchers wrote a property from one account’s container and read it back from a separate account’s container shortly afterwards, with larger amounts of data split into smaller parts and reassembled on the receiving end. From that point, an attacker’s session could place a task in the shared storage, which a victim’s session would then check for and carry out during its next reply.
Triggering the issue required limited input from a victim, according to the study, with a prompt entered directly into a chat, a shared conversation link, or a custom GPT containing a hidden instruction all sufficient to activate the channel.
Once triggered, ChatGPT carried out the planted task using the permissions already available to the victim’s session, wrote the result back to the shared storage, and responded to the victim’s original question separately. The extent of what could be accessed depended on the victim’s existing permissions and could include conversation history and files within the affected chat, as well as connected apps such as Gmail, Google Drive, Microsoft Teams or GitHub.
In the study’s demonstration, ChatGPT retrieved the victim’s email data through a connected Gmail account and made it available to the attacker’s session within a single exchange. The study finds this occurrence because ChatGPT’s default settings approve certain read actions automatically, without a separate confirmation step for actions considered low risk.
The only indication of the activity, according to the study, was a label reading “Talked to Gmail” attached to the response, which appeared after the data had already been retrieved rather than before.
CPR disclosed its findings to OpenAI, which confirmed that the specific internal Artifactory instance identified in the research has since been decommissioned. CPR said its proof of concept had already been developed before a separate chain of activity on the same Artifactory instance led to the Hugging Face compromise that OpenAI has since disclosed publicly, noting that the two incidents were technically distinct but involved the same underlying infrastructure.
The study applies more broadly to AI assistants that hold credentials, tool access and connections to external services, stating that such systems could be directed to use permissions granted by a user to carry out actions requested by a third party instead.
The findings recommended that organisations maintain visibility into which AI tools are in use and what those tools are connected to, and said this is an area where gaps in oversight often begin. The firm also recommended runtime protection to detect manipulation attempts and limit the movement of sensitive data, along with governance measures to monitor the actions taken by AI systems in addition to their outputs.
CPR said the research was conducted as part of its ongoing work with OpenAI on AI security disclosures.
