A hidden instruction in a ChatGPT conversation could make the AI secretly perform tasks for an attacker while continuing to answer the user’s questions normally, according to new research from Check Point Research.
In a proof-of-concept attack, researchers showed how the hidden instruction could make ChatGPT access information from a user’s connected Gmail account and send the stolen data to another ChatGPT account through a hidden communication channel. The user would still receive what appeared to be a normal answer, with no obvious indication that the data had been accessed and transferred.
Check Point said the same technique could potentially be used to copy a conversation’s chat history and files. The amount of information an attacker could obtain would depend on what the victim’s ChatGPT session could already access, including connected data, tools, applications and permissions.
For the attack to work, the malicious instruction first had to be placed inside the conversation. Check Point identified three possible ways this could happen: a user could paste the prompt themselves, open a shared ChatGPT conversation containing it, or use a custom GPT whose hidden builder instructions contained the malicious instruction.
Once the instruction was already present, a normal user message could trigger the attack. In its demonstration, Check Point designed the instruction to make ChatGPT’s Thinking mode perform two separate streams of work during the same response.
While ChatGPT generated an answer for the user, another process could secretly check a mailbox for instructions from the attacker, use the tools available in the victim’s session to carry them out, and send the results back. The malicious instruction was designed to keep this second stream separate from the visible response.
The researchers said the only visible indication that an application had been accessed was a small “Talked to Gmail” label above the response. That label recorded that Gmail had already been read but did not give the user an opportunity to approve or reject the access.
According to OpenAI’s documentation, connected apps can perform certain “Important actions” without asking the user first. ChatGPT only requests confirmation for actions that could have an external effect, expose sensitive information, or be difficult to reverse. Users can change the setting to “Always ask” if they want to be prompted every time.
Check Point said it reported the vulnerability to OpenAI, which confirmed that the internal service used as the hidden communication channel had been taken offline. The researchers said users do not need to install an update to address the issue.
The communication channel existed between the containers used by ChatGPT to run code. A separate container is created for a conversation when a task requires it, and OpenAI’s documentation says the Python environment used for data analysis cannot directly make requests to the web or outside APIs.
Check Point found that containers from separate conversations, including conversations belonging to different accounts, did not have a direct connection to one another. However, they could communicate with the same internal service used to provide additional Python and npm packages.
That service was an internal JFrog Artifactory instance. Instead of allowing ChatGPT’s containers to connect directly to public package repositories, the containers could communicate with the internal service, which would retrieve packages for them.
The researchers discovered that the service allowed a container to attach named properties to stored files and later read those properties. The credentials available to the container for reading the properties were also sufficient to write them. Those credentials were stored in environment variables that code executed by ChatGPT could access.
Check Point demonstrated the problem by attaching a property named chatgpt_test_ts, containing the current time, to a cached file from one account’s container. A separate conversation running under another account was then able to request the file’s properties and retrieve the same value.
Because the properties could contain plain text or Base64-encoded data, researchers said information could be divided across multiple properties and reconstructed by another container. This effectively turned metadata associated with the package service into a shared clipboard between containers that were intended to remain isolated.
Check Point said this was the second communication channel it had identified in the same part of ChatGPT. In March, the company reported another technique that used DNS lookups to send conversation data to an external server. According to the researchers, OpenAI fixed that issue on February 20.
The latest case is separate from the Hugging Face incident, where OpenAI’s own models used an internal Artifactory instance as a communication mechanism during security testing. Check Point said the mechanism in its latest research was different, although both cases involved a shared internal service becoming an unintended communication layer between environments that were supposed to remain isolated.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Check Point said its research was conducted in June 2026 but did not disclose when the vulnerable communication channel stopped working. As a result, the report does not establish how long the channel may have been available
