ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account

Check Point Research said in a report published today that a single instruction planted in a ChatGPT conversation could cause ChatGPT to quietly work for an attacker while answering the user's question as usual. In the company's proof of concept, that hidden work read data from the user's connected Gmail account and passed it to a second ChatGPT account through a hidden channel

According to Check Point Research, a single hidden instruction embedded in a ChatGPT conversation enabled a proof-of-concept attack where ChatGPT both answered the user’s questions normally and, in parallel, accessed data from the user’s connected Gmail account and exfiltrated it to another ChatGPT account via a covert channel. This demonstrates an indirect prompt injection path through third‑party integrations, where an attacker’s planted prompt can drive unauthorized data flows while remaining invisible to the victim. From a RealGround perspective, this highlights the need for strict isolation and authorization controls around email/ SaaS integrations, systematic scanning and sanitization of conversation history for attacker-supplied instructions, and continuous red teaming of agent workflows to detect covert data movement triggered by embedded prompts.