Check Point Research Identifies ChatGPT Flaw Enabling Gmail Data Exfiltration

SAN FRANCISCO — A critical vulnerability in OpenAI's ChatGPT service allowed attackers to silently extract Gmail data from one user's account and transfer it to another via shared internal infrastructure, security researchers announced Monday.

Check Point Research disclosed the flaw on Sept. 8, 2026, detailing how a malicious prompt could exploit an architectural weakness in the platform's container management system. The vulnerability stemmed from a misconfiguration in an internal JFrog Artifactory instance, a software repository tool used to manage build artifacts. This error permitted containers belonging to different user accounts to share metadata, creating a bridge for unauthorized data movement.

The researchers demonstrated that by planting a specific prompt within the ChatGPT interface, an attacker could trigger the exfiltration of sensitive email content from a victim's Gmail account. The data was not merely displayed but was routed through the shared Artifactory metadata channel to a destination controlled by the attacker. The mechanism operated silently in the background, leaving no immediate trace in the user's chat history or standard interface logs.

OpenAI has acknowledged the report and is working on a patch to isolate container environments and secure the internal repository access. The company stated that the vulnerability was contained before it could be weaponized at scale, though the exact window of exposure remains under review. Security experts note that the incident highlights the risks associated with complex microservices architectures where shared resources can inadvertently become vectors for cross-account data leakage.

The flaw specifically targeted the interaction between the user's prompt processing container and the internal build system. In a standard configuration, these environments are strictly segregated. However, the misconfigured Artifactory instance allowed metadata from one tenant to be readable by another, effectively bypassing standard access controls. This allowed the exfiltration of Gmail data, which was likely cached or processed within the temporary container environment during the AI generation process.

Check Point Research emphasized that while the attack vector required specific conditions, the potential impact extends beyond email data to any sensitive information processed within the compromised containers. The discovery has prompted a broader industry review of how artificial intelligence platforms manage internal service dependencies and artifact repositories.

Questions remain regarding the duration of the vulnerability's existence prior to its discovery and whether other users were affected before the patch was deployed. OpenAI has not yet released a detailed timeline of the remediation process or confirmed if any user data was successfully exfiltrated in real-world attacks. As the investigation continues, cybersecurity firms are advising organizations using similar internal artifact management systems to audit their container isolation protocols immediately.