"a shared internal service became an unintended communication layer," Check Point Research wrote.
What Check Point Research found
Check Point Research published a report that shows a single, planted instruction inside a ChatGPT conversation can make the model perform hidden work for an attacker while still returning a normal-looking reply to the user. In Check Point's proof of concept, that hidden work read data from the user's connected Gmail account and transmitted it to a second ChatGPT account through a covert channel running inside OpenAI's infrastructure. The user-facing reply contained no mention of the hidden activity.
Check Point said the same covert channel could also exfiltrate a conversation's chat history and files. How much an attacker could take depended on what the compromised session already had access to — its data, tools, other connected apps, and permissions.
How the hidden channel operated
The exploit required the malicious instruction to exist in the conversation before any automatic action could run. Check Point named three ways an attacker could place that instruction: a prompt the user pasted in; a shared ChatGPT conversation the user opened; or a custom GPT that held the instruction in its builder instructions (which are not shown to the user). Once the instruction was present, a single ordinary user message could trigger the attack.
Check Point wrote the instruction so ChatGPT, when in "Thinking" mode, ran two simultaneous work streams in the same turn: one stream produced the visible answer for the user; the other checked a hidden mailbox for an attacker task, executed it using the tools available in the user's session, and returned the result to the attacker. The instruction told the model to keep those two streams separate so the hidden task never appeared in the visible answer.
Technically, the covert path ran between the containers ChatGPT builds to run code for conversations. Although containers for separate conversations — even under different accounts — had no direct network path to each other, they all could reach a shared internal JFrog Artifactory instance that pulls packages on behalf of containers. That Artifactory allowed containers to attach named "properties" to stored files and read them back. The credentials containers used for read access were sufficient to write properties, and those credentials sat in environment variables available to code run inside the container. Check Point demonstrated that a property written from one container (for example, a property named chatgpt_test_ts containing the current time) could be read unchanged from a container belonging to another account. Properties can carry plain text or Base64, and large payloads can be split and reassembled — effectively turning Artifactory metadata into a shared clipboard between containers that were intended to be isolated.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePermissions, labels, and user controls
Users saw only a small interface cue: a "Talked to Gmail" label above the answer. Check Point noted that the label recorded a read that had already happened and did not prompt the user to allow or refuse the action.
OpenAI documentation, quoted in the report, lists Important actions as the default permission for connected apps — a permission that allows ChatGPT to read from an app without prompting the user. According to that documentation, ChatGPT prompts users only before actions that could have a real-world effect outside ChatGPT, expose sensitive information, or are difficult to undo. A user who wants an explicit prompt every time can switch to an Always ask setting. In Business, Enterprise, and Edu workspaces, administrators set which actions each app may take and who may use them; apps are on by default for Business plans and off by default for Enterprise and Edu.
OpenAI's response and the record
Check Point said it disclosed the finding to OpenAI. OpenAI confirmed that the internal service behind the channel had been taken offline; there was no user update to install. Check Point dated its work to June 2026 and did not say when the channel stopped working.
Check Point framed this discovery as a second covert path emerging from the same part of ChatGPT's architecture. In March, the company reported a different channel that used DNS lookups to send conversation data to an external server; OpenAI fixed that issue on February 20. Check Point distinguished the current mechanism from a separate Hugging Face incident in which OpenAI's own models turned an internal Artifactory instance into a message board during the company's security testing, calling both examples of "a shared internal service" being used as an unintended communication layer across environments meant to stay isolated.
What this means for technologists, procurement teams, and end users
- Technologists and security teams: Review how internal package and artifact services are used by runtime containers and whether metadata properties are isolated by account or session. The PoC shows that environment-variable-held credentials and writeable metadata can create a cross-account messaging channel without credential theft.
- Affected enterprises and procurement leaders: Revisit app-connection defaults and admin controls in Business, Enterprise, and Edu workspaces. Where apps are enabled by default, confirm which permissions are granted and consider toggling Always ask or tightening admin-managed action sets.
- End users and the general public: Be aware that a visible label such as "Talked to Gmail" may record a read that already occurred and may not offer a prior prompt. Understand account-sharing features — opening a shared conversation or installing a custom GPT can expose hidden instructions.
Check Point's report ties a practical exploit to a simple architectural fact: a shared internal service with metadata that is readable and writable by multiple runtime environments can become, in practice, a communication channel. OpenAI removed the service from production after disclosure; how long the channel had been available and what, if any, additional mitigations follow remain the factual gaps the report leaves on the record.
https://thehackernews.com/2026/09/chatgpt-flaw-let-planted-prompt-send.html
