Researchers from Check Point Research have disclosed a covert communication channel that enabled attackers to transmit commands between isolated ChatGPT sessions belonging to different accounts.
The vulnerability stemmed from an internal JFrog Artifactory instance accessed by ChatGPT containers during software package installation. Although containers could not communicate directly, they shared access to this repository and could read and write object metadata, effectively turning the service into a shared clipboard.
To initiate the attack, a malicious instruction had to be placed into the victim's context, for example via a copied prompt, a shared conversation, or a specially crafted custom GPT. Once the user sent a normal message, the assistant would check the hidden channel, retrieve the task, and execute it using the permissions of the current session.
In a proof-of-concept demonstration, ChatGPT accessed data from the victim's connected Gmail account and transmitted it to the researcher's account while displaying only a standard reply. The sole visible indicator was a small note reading "Talked to Gmail" that appeared after the data had already been read.
The potential impact depended on the session's connected services and could include exposure of chat history, uploaded files, and information from linked accounts such as Gmail, Google Drive, Microsoft Teams, and GitHub.
Check Point Research reported the issue to OpenAI. The company confirmed that the relevant JFrog Artifactory instance has been decommissioned, rendering the described channel inoperable. No evidence of the technique being used in real-world attacks has been found.
