Check Point Research demonstrated a prompt-injection technique where a hidden instruction planted in a ChatGPT conversation could make ChatGPT quietly read a user’s connected Gmail and pass the data to another attacker-controlled ChatGPT account. The user still received a normal-looking answer, with little indication that Gmail data had been accessed. The issue relied on how connected-app permissions work by default and an internal service that unintentionally allowed cross-account communication.
Check Point Research demonstrated a prompt-injection technique against ChatGPT that relied on planting a hidden instruction inside a conversation before the target ever interacted with it. That instruction could arrive three ways: a prompt the user pastes in, a shared ChatGPT conversation the user opens, or a custom GPT whose builder instructions are never shown to the user. Once the hidden instruction was in place, a single ordinary message from the user was enough to trigger it.
In the proof of concept, the hidden instruction caused ChatGPT to read data from the user's connected Gmail account and pass it to a second, attacker-controlled ChatGPT account through a channel between the two accounts. The user's visible reply said nothing about any of this happening in the background.
The technique worked because connected-app permissions default to broad access, and the only visible trace of the Gmail read was a small "Talked to Gmail" label appearing above the answer. That label recorded a read that had already happened, giving the user no opportunity to approve or refuse it in the moment. The scope of what an attacker could reach depended entirely on what the session already had access to, including data, tools, other connected apps, and permissions already granted.
OpenAI confirmed that the internal service enabling the cross-account channel was taken offline, meaning there was no user-side patch to install. Even so, the underlying pattern, granting an AI assistant broad standing access to sensitive accounts, remains a factor organizations should weigh when configuring connected apps.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A hidden instruction planted in a conversation, pasted prompt, or custom GPT's builder instructions could trigger ChatGPT to quietly read data from a user's connected Gmail account and send it to a second attacker-controlled ChatGPT account, all while the visible reply looked normal.
The only indicator was a small "Talked to Gmail" label above the answer, which appeared after the read had already occurred and gave the user no chance to approve or deny it.
No. OpenAI confirmed the internal service that enabled the cross-account channel was taken offline, so there was no user-side patch required.
Tighten connected-app permissions by using settings like "Always ask" for reads, rely on admin controls in Business, Enterprise, or Edu workspaces to govern which actions apps may take, and avoid opening shared conversations or custom GPTs with instructions you can't verify.
Imagine you open a shared ChatGPT conversation, ask a normal question… and it quietly reads your Gmail in the background. Check Point showed a hidden instruction planted in the chat that made ChatGPT read a user’s connected Gmail and send it to a second ChatGPT account. The visible reply looked totally normal. That planted prompt could come from a shared chat link or a custom GPT with hidden builder instructions. One ordinary message from you is enough to trigger it, and the only clue is that tiny 'Talked to Gmail' label after the fact. If you ever see 'Talked to Gmail' or another app label when you didn’t use that app on purpose, stop using that chat and report it to Security immediately.
Check Point researchers demonstrated a real proof-of-concept where a victim’s ChatGPT session could be tricked into running hidden, attacker-controlled tasks in parallel with the user’s normal request. In the demo, the attacker used a covert cross-account channel to make ChatGPT access the victim’s…
Researchers showed that AI coding agents from Anthropic, Google, and OpenAI could be tricked by untrusted GitHub inputs (like an issue or workflow file) into taking unsafe actions. In the demos, a single malicious issue or writable workflow file could lead to remote code execution, stolen…
Check Point Research described a covert cross-account channel in OpenAI’s internal JFrog Artifactory that could let an attacker sneak hidden instructions into another user’s ChatGPT session. In their demonstration, the victim saw normal chatbot output while the model quietly pulled data (like Gmail…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Check Point reports that OpenAI’s ChatGPT became a top-10 most impersonated brand in Q2 2026 phishing. One observed example used a fake “ChatGPT Plus payment failed” billing email to drive victims to a credit-card theft page. The report also notes other brand-impersonation scams using cloned stores…
