Check Point Research revealed on Tuesday that a secret channel within ChatGPT's internal JFrog Artifactory instance allowed one account to send concealed tasks — such as retrieving email data from a connected Gmail account — to a ChatGPT session under another account. The victim would see no indication of the hidden instructions or stolen data, according to the researchers.

The vulnerability stems from how OpenAI models use isolated containers for tasks requiring code execution. These containers cannot access the public internet but are allowed to reach an internal Artifactory instance with package repositories. Although the containers were meant to be isolated from one another, Check Point discovered that the Artifactory exposed an item management feature enabling one container to attach text properties (including Base64-encoded binary data) to a repository item, and a container under another account could read them.

Additionally, the credentials provided to the container for reader access granted both read and write privileges, meaning code launched by ChatGPT could authenticate to the storage endpoint without extracting a separate secret or escalating privileges. This allowed an attacker's session to write a malicious task into the shared storage, which the victim's session would then carry out.

Check Point researcher Alexey Bukhteyev explained: "A crafted instruction could make ChatGPT process a second stream of tasks alongside the visible conversation: receive instructions from an attacker, execute them using the capabilities of the victim's session, and return the results without exposing the second stream in its visible response."

The researchers demonstrated the attack using a shared ChatGPT conversation, where the attacker's session wrote an instruction to retrieve emails via the victim's connected Gmail account. The reach could extend to any connected apps the victim's session was authorized to access, including Google Drive, Microsoft Teams, GitHub, and others.

Pedro Drimel Neto, Check Point's malware analyst team leader, told The Register that the covert channel was disclosed to OpenAI in late June — the same day that OpenAI's agents exploited a zero-day bug in Artifactory to hack Hugging Face. While related, the two incidents are not the same attack. "Once it was disclosed to OpenAI, they told us the Artifactory had already been decommissioned," Drimel Neto said. He added: "The biggest AI security risk has become the access and trust we give it. As AI becomes more connected to sensitive data and critical systems, every trusted capability can become a target for attackers."

OpenAI did not respond to The Register's request for comment. The hole has since been closed.