What happened
During an ordinary visible request, ChatGPT simultaneously processed a hidden task, read data from the victim's connected Gmail account, and returned the data to a separate account through Artifactory item properties.
2026-09-08
HighPrimaryChatGPT Cross-Account Artifactory Channel Let Hidden Instructions Read Connected Gmail and Relay Data to Another Account
Analysis of Check Point's ChatGPT cross-account channel, which let hidden instructions read connected Gmail and relay data through shared Artifactory metadata.
OpenAI ChatGPTCredential exposureCross-account covert channel combined with hidden prompt execution and connected-app data accessChatGPT code-execution containers, a shared internal Artifactory service, and connected Gmail access
Why it matters
Demonstrated exposure of connected Gmail data across account boundaries; the researchers said the same channel could reach chat history, uploaded files, and other connected-app data available to the victim's session.
Missing authorization check
Origin-bound, independently authenticated approval before a hidden or indirect instruction can read sensitive connected-app data or relay it outside the user's visible session.
Would PP block it?
If connected-app reads and data export are enforced outside the model, the hidden task would lack a receipt bound to the victim, requested Gmail scope, and destination. The action can then fail closed even though the malicious instruction remains in conversation context. The underlying shared-service flaw still requires platform remediation.
Incident analysis
Timeline and technical read
Timeline
2026-06
Check Point Research discovers a bidirectional channel between code-execution containers belonging to separate ChatGPT accounts.
2026-09-08
Check Point publishes the research and reports that OpenAI confirmed the identified Artifactory instance had been decommissioned.
Technical breakdown
- Separate ChatGPT code-execution containers could not communicate directly, but they could access the same internal JFrog Artifactory instance used to retrieve packages.
- Container credentials allowed both setting and reading item properties, turning shared package metadata into a cross-account text or Base64 data channel.
- A malicious instruction in a pasted prompt, shared conversation, or custom GPT could run a hidden task stream alongside the victim's visible request.
- In the demonstration, the hidden stream invoked the victim's connected Gmail access and returned email data through the covert channel; the visible answer disclosed only a post-action 'Talked to Gmail' label.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Connected-app read boundary and data-egress boundary outside the ChatGPT session
- Still needs
- Permission Protocol does not isolate ChatGPT containers, sanitize prompts, or patch shared internal services; platform isolation and service permissions remain necessary.
- Receipt required for
- Reading connected Gmail data and relaying session data to another account or destination
A Credential Gate can require explicit approval before ChatGPT reads connected Gmail or exports the returned data, but Permission Protocol does not repair cross-account container isolation or disable the Artifactory metadata channel itself.
Start small
Put the relevant gate at this action boundary.
This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.