Hidden channel in ChatGPT may allow access to Gmail accounts
By newsbot | Published on 08-09-2026 15:12 | Categories: News
In a proof-of-concept attack, an attacker session could secretly instruct the victim's ChatGPT to retrieve and transfer data, leveraging the user's own legitimate permissions.
Check Point Research (CPR), the research arm of Check Point Software Technologies Ltd., has discovered a hidden communication channel between different accounts in ChatGPT that allowed an attacker session to secretly grant a victim's ChatGPT access to data, using permissions already granted by the user.
See more articles from iGuRu.gr when you search for news on Google.
In CPR’s proof of concept, ChatGPT retrieved information from a victim’s connected Gmail account and passed it to the attacker, while the user’s conversation continued to appear perfectly normal. The research highlights a broader challenge for AI security: as AI assistants are connected to more business applications and sensitive data, the risk of them being manipulated to act as a “coerced insider” within an organization’s trust boundaries increases.
AI assistants as "forced internal agents"
The finding challenges a fundamental assumption underlying the adoption of artificial intelligence: that users, sessions, and accounts within AI platforms remain completely isolated from each other.
Unlike a conventional cyberattack, the technique demonstrated by CPR did not require stealing credentials, installing malware, or directly compromising the victim’s account. It leveraged existing permissions already granted to the AI assistant. According to the research, a malicious prompt, shared chat link, or custom GPT could trigger the attack and, depending on the user’s permissions, allow access to data available through connected services, such as Gmail, Google Drive, Microsoft Teams, and GitHub.
This new category of risk does not concern an AI system that autonomously decides to deviate from its purpose. It concerns the ability of an attacker to silently influence another user's AI assistant and lead it to perform actions on their behalf, with legitimate access and through already trusted relationships.
For businesses, public organizations, and critical infrastructure operators that are integrating AI into their daily operations, the finding shows that productivity tools can inadvertently widen the attack surface when there is insufficient visibility, governance, and protection in place during their operation.
A different security challenge for the AI era
Public debate has recently focused on AI agents taking unpredictable actions, bypassing security controls, or behaving in ways their creators did not anticipate. Check Point Research's findings highlight a different and potentially more immediate risk: the manipulation of AI systems to carry out attackers' commands, using legitimate permissions granted to them by the user.
The need for strict separation between different AI environments was recently highlighted by the Hugging Face incident. According to OpenAI's assessment, agents operating in separate evaluation environments created unauthorized communication channels through which they could exchange information and coordinate actions.
At the same time, Check Point Research was independently investigating a related isolation issue in ChatGPT. The researchers identified a hidden, two-way communication channel between code execution environments belonging to different conversations and different user accounts. While the technical mechanism differed from that described in OpenAI’s findings, in both cases a shared internal service acted as an unintended layer of communication between environments that were designed to remain isolated.
As AI assistants gain access to enterprise applications, cloud services, and corporate data, the attack surface expands beyond users, devices, and applications to include the AI agents acting on their behalf. The abuse of trusted infrastructure and legitimate rights creates a new attack model, in which activity can remain invisible to the user.
Prevention, visibility and control during operation
Traditional cybersecurity practices focus on protecting identities, devices, and applications. In AI-powered workplaces, organizations now need to consider how an attacker can manipulate an AI agent to abuse authorized access without the user realizing it.
The research highlights the need for visibility into interactions with AI systems, stronger governance mechanisms, real-time protection, and a prevention-first approach. These requirements become particularly critical as businesses and public organizations accelerate the adoption of AI and grant it access to more and more functions and data.
“This research shows that the security challenge around AI is no longer just about the model itself, but also about the access and trust we grant it. As AI assistants increasingly connect to corporate systems and sensitive data, organizations must consider every authorized capability as a potential target for abuse. An approach that prioritizes prevention, combined with visibility, governance, and protection at work, is essential to ensure AI remains a driver of business growth and does not become a new avenue for cyber risk. Organizations that will stay ahead are those that protect interactions with AI before attackers can exploit them.” Eli Smadja, Head of Research, Check Point Research
