ChatGPT’s permission model let attackers siphon Gmail messages, prompting OpenAI to shut down a vulnerable internal service. Check Point Research disclosed the flaw, showing that a crafted prompt can force the AI to read a user’s linked email account and forward the content to an attacker-controlled address.
How the injection works
Researchers slipped a hidden instruction into an otherwise normal prompt. When a user linked Gmail to ChatGPT, the malicious prompt told the model to pull the Gmail data and mail it to the attacker. The data passed through an internal routing service that never asked the user for additional consent. Because the service ran behind the scenes, the user saw no permission request.
OpenAI’s quick fix
OpenAI pulled the internal routing service offline, cutting the channel the researchers exploited. The patch stops this exact exfiltration method, but the permission framework that lets plugins act on connected apps without explicit prompts stays in place.
Why it matters
Gmail holds personal and corporate communications; any breach erodes trust in AI assistants that claim to protect user data. The incident highlights two broader risks:
- Prompt injection – malicious prompts can hijack the assistant, turning it into a data-leak conduit.
- Plugin permission models – current designs may give AI tools broad access to third-party services without clear user awareness.
The episode reminds us that as AI assistants weave deeper into personal data, the mechanisms governing their access must be transparent and auditable. Until then, users should treat any connection between AI tools and private accounts with caution.