Check Point researchers demonstrated a real proof-of-concept where a victim’s ChatGPT session could be tricked into running hidden, attacker-controlled tasks in parallel with the user’s normal request. In the demo, the attacker used a covert cross-account channel to make ChatGPT access the victim’s connected Gmail and send email data back to the attacker, while the victim saw an ordinary response.
Researchers found a covert cross-account communication channel between code-execution environments tied to different ChatGPT accounts, made possible by a shared internal package service. An attacker could plant hidden instructions in a few different ways: embedding them in a shared chat link, or hiding them inside a custom GPT's builder configuration, which is not shown to the user. Once a victim opened the link or used the GPT and sent any normal message, the hidden instruction ran in the same turn as the visible request.
In the proof of concept, this hidden task caused ChatGPT to access the victim's connected Gmail account and relay retrieved email data back to the attacker through the covert channel, all while the victim received what looked like an ordinary, unrelated answer.
Several factors combined to make this work convincingly:
The only user-visible indicator in the demonstrated scenario was a small label, such as "Talked to Gmail," appearing above the answer. Importantly, this label only recorded an action that had already taken place, it did not give the user any chance to approve or reject it beforehand. Employees and teams using ChatGPT with connected apps like email, drive, Teams, or GitHub should watch for:
Organizations and users can reduce exposure by treating shared ChatGPT conversations and custom GPTs the same way they would treat unfamiliar links, verifying the sender and purpose before using them for real work. Business-critical apps such as email, drive, chat, and source control should only be connected to AI tools after understanding and reviewing the permission settings involved. Where available, choosing the stricter "Always ask" setting for connected apps, especially for email and document systems, gives users a chance to approve actions before they happen rather than discovering them afterward. Finally, awareness training should specifically cover unexpected app-access indicators so employees know to report them immediately rather than dismiss them as routine.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers planted hidden instructions in a shared ChatGPT conversation link or a custom GPT's hidden configuration. When the victim opened the link and sent a normal message, the hidden instruction ran alongside it, using a covert cross-account channel to access the victim's connected Gmail and send data to the attacker.
The only visible clue was a small post-action label like 'Talked to Gmail' appearing above the answer. This label recorded an action that had already happened and did not give the user a chance to approve or reject it beforehand.
OpenAI decommissioned the internal Artifactory instance involved, and the specific cross-account channel described in the research was no longer available by the time the report was completed.
Treat shared ChatGPT conversations and custom GPTs like untrusted links, avoid connecting business-critical apps to AI tools without reviewing permissions, and use stricter 'Always ask' approval settings for connected apps where available.
Imagine you click a shared ChatGPT link from a ‘colleague’… you type any message… and behind the scenes it quietly reads your Gmail. Researchers showed a hidden task attack: a shared ChatGPT chat or custom GPT embeds secret instructions. Your normal prompt runs, but in parallel it uses your connected apps, like Gmail, to pull data and send it back through a covert channel. In the demo, the victim just opened the link and sent a normal message. ChatGPT showed a regular answer, but a tiny label above it read “Talked to Gmail” even though they never asked it to touch email. That’s your only visible clue. If you ever see a shared ChatGPT chat or custom GPT accessing apps you didn’t ask for, like a surprise “Talked to Gmail” label, stop using it and report it immediately to security.
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
Check Point reports that OpenAI’s ChatGPT became a top-10 most impersonated brand in Q2 2026 phishing. One observed example used a fake “ChatGPT Plus payment failed” billing email to drive victims to a credit-card theft page. The report also notes other brand-impersonation scams using cloned stores…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Check Point Research described a covert cross-account channel in OpenAI’s internal JFrog Artifactory that could let an attacker sneak hidden instructions into another user’s ChatGPT session. In their demonstration, the victim saw normal chatbot output while the model quietly pulled data (like Gmail…
Researchers showed how a malicious web page could trick OpenAI’s Atlas AI-enabled browser into taking actions a user didn’t intend, like spamming WhatsApp contacts or modifying an Amazon account. The attacks used prompt-injection style instructions hidden in a seemingly legitimate “newsletter…
