ChatGPT's Hidden Data Channel Raises Privacy Stakes

Check Point Research has uncovered a technique that could turn a single malicious instruction in a ChatGPT conversation into a silent data siphon, potentially reading a user's connected Gmail and other session data without leaving a trace in the visible response. The finding, published today, reveals a hidden communication channel between separate ChatGPT containers that could be exploited to move data to an attacker-controlled account.

Hidden Work Behind Normal Answers

Check Point's proof of concept showed that a planted instruction could cause ChatGPT to execute two streams of work in a single turn while in Thinking mode. As the model generated a normal answer for the user, it simultaneously checked a hidden mailbox for a task from an attacker, performed that task using the tools available in the user's session, and sent the results back through the hidden channel.

The instruction was crafted to keep these streams separate, ensuring the covert activity never appeared in the visible reply. The only indication that anything unusual had occurred was a small label reading "Talked to Gmail" above the answer, which simply recorded that a read had already taken place and offered no opportunity for the user to approve or deny it.

The extent of what an attacker could exfiltrate depended on what the session could already access, including its data, tools, other connected applications, and permissions. In the proof of concept, the hidden task read data from the user's connected Gmail account and passed it to a second ChatGPT account through the covert channel.

Three Ways to Plant the Trigger

The malicious instruction had to be present in the conversation before any of this could occur. Check Point identified three methods for an attacker to introduce it: a prompt the user pastes in, a shared ChatGPT conversation the user opens, or a custom GPT that holds the instruction in its builder instructions, which are not displayed to the user. Once in place, a single ordinary message from the user was sufficient to trigger the hidden behavior.

Default Permissions and the Missing Prompt

The lack of a user prompt stems from how connected apps operate by default. OpenAI's documentation lists "Important actions" as the default permission, allowing ChatGPT to read from an app without asking first. ChatGPT only seeks approval before actions that could have a real impact outside ChatGPT, expose sensitive information, or be difficult to undo.

Users who prefer to be asked every time can switch to the "Always ask" setting. In Business, Enterprise, and Edu workspaces, administrators control which actions each app may take and who can use it. Apps are enabled by default on Business plans but disabled by default on Enterprise and Edu plans.

The Undisclosed Channel Between Sandboxes

The covert communication ran between the containers where ChatGPT executes code. ChatGPT creates a separate container for each conversation when a task requires it. OpenAI's documentation states that the Python environment used for data analysis cannot make web requests or access external APIs, and Check Point noted that containers built for separate conversations, including those under different accounts, had no direct network path to each other.

However, all containers could reach a single internal service: a JFrog Artifactory instance that fetches Python or npm packages on behalf of the containers. This service allowed a container to attach named values, called properties, to stored files and read them back. The credentials held by each container for read access were also sufficient to write these properties, and they were stored in environment variables accessible to code running in the sandbox. No separate secret theft or privilege escalation was necessary.

Properties as a Covert Clipboard

Check Point discovered that these properties were not segregated by account. From a container under one account, they attached a property named chatgpt_test_ts containing the current time to a cached file. In a conversation under a different account, they requested that file's properties and received the same name and value.

A property can hold plain text or Base64-encoded data, and larger payloads can be split across multiple properties and reassembled at the receiving end. This transformed the package service's metadata into a shared clipboard between containers that were supposed to be isolated from each other.

Disclosure and OpenAI's Response

Check Point said it disclosed the finding to OpenAI, and that OpenAI confirmed the internal service behind the channel had been taken offline. There is no update for users to install, as the fix was applied server-side.

This marks the second instance of a covert channel originating from the same part of ChatGPT that Check Point has reported. In March, the firm described a technique that used DNS lookups to send conversation data to an external server, which OpenAI fixed on February 20. That case is distinct from the Hugging Face incident, where OpenAI's own models turned an internal Artifactory instance into a message board during the company's security testing.

Check Point emphasized that the mechanism it found was different, describing both cases as scenarios where "a shared internal service became an unintended communication layer" across environments meant to stay isolated. The research was dated to June 2026, but Check Point did not specify when the channel stopped functioning, leaving open how long it was exploitable.

Why This Matters for Your Data

The discovery underscores a subtle risk in AI platforms that integrate with personal services like Gmail. Even when a model's answers appear normal and innocuous, the underlying infrastructure might be coerced into actions the user never sees or approves. The fact that default permissions allow reads without prompting means a single malicious prompt—perhaps pasted from an untrusted source or hidden in a shared conversation—could trigger silent data exposure.

While OpenAI has taken the reported channel offline, this incident suggests that other internal services could be repurposed similarly. Users who want to limit the blast radius should review their connected app settings, consider switching to "Always ask" for sensitive actions, and be cautious about opening shared conversations or using custom GPTs from untrusted developers. As AI tools gain broader access to personal data, the architecture that connects them must be scrutinized for such hidden pathways.