Gmail

Check Point Research Uncovers Cross-Session Command Channel in ChatGPT via JFrog Artifactory

Researchers at Check Point Research identified a covert channel that allowed commands to be passed between isolated ChatGPT sessions belonging to different user accounts. The channel exploited an internal JFrog Artifactory instance used by ChatGPT containers for package installation, enabling containers to read and write repository metadata that effectively served as a shared buffer. Attackers could inject malicious instructions into a victim's context through copied prompts, shared conversations, or custom GPTs, causing the assistant to execute hidden tasks while returning normal responses. In a demonstration, ChatGPT silently retrieved data from a connected Gmail account and forwarded it to the attacker's account. The technique potentially exposed chat history, uploaded files, and data from connected services including Google Drive, Microsoft Teams, and GitHub. OpenAI confirmed the affected Artifactory instance has been decommissioned, eliminating the channel, with no evidence of real-world exploitation reported.

Gmail Address Variants Bypass String Comparison and Enable Multiple Registrations

A single user created four separate accounts using valid Gmail address formats that all deliver to the same inbox: Ivan.Petrov@gmail.com, ivanpetrov@gmail.com, ivan.petrov+shop@gmail.com, and IVAN.PETROV@gmail.com. Simple string comparison in the registration code treated these as distinct entries, allowing circumvention of new-user promotions, free-tier limits, and one-application-per-person rules. The root cause lies in three Gmail-specific behaviors: case-insensitive local parts, plus-addressing that ignores everything after the + symbol, and dots that carry no semantic meaning in the local part. Additional risks arise from IDNA homograph domains that visually mimic legitimate addresses but encode to different Punycode strings. Proper mitigation requires storing both the original email for delivery and a domain-aware normalized form for uniqueness checks, combined with explicit IDNA validation on registration.

Password Reset Fails to Evict Attackers: What Persists in Compromised Email Accounts

Even after users change passwords and enable two-factor authentication, attackers often retain access through active sessions, application tokens, and forwarding rules. The original password serves only as an entry point, while already-issued session cookies, refresh tokens, and app passwords continue functioning independently. Services like Google, Microsoft, and Yandex provide specific pages to review devices, permissions, and app passwords, yet many users overlook the critical "sign out all devices" option. In corporate environments, Microsoft Entra ID commands can revoke sessions, but access tokens may still remain valid for up to an hour afterward. Attackers frequently replace recovery details and set up mail delegation or hidden forwarding rules to maintain long-term control. The recommended sequence prioritizes session revocation first, followed by password change, MFA review, and recovery data verification to prevent re-entry via forgotten-password flows.

AgentForger Vulnerability in ChatGPT Workspace Agents Enabled Malicious AI Deployment via Single Phishing Link

A vulnerability in ChatGPT Workspace Agents allowed attackers to create and deploy a malicious AI agent inside an organization from a single phishing link. Named AgentForger, the flaw was fixed by OpenAI on June 8, 2026. The attack exploited a permissive parameter in the Agent Builder that accepted instructions directly through the URL. An authenticated user opening the prepared link would trigger automatic execution of the command without additional confirmation. The victim required access to Workspace Agents and at least one pre-authorized enterprise connector such as Outlook, Gmail, Google Drive, Slack, Teams, or Google Calendar. The malicious prompt instructed the platform to create an agent, connect available applications, disable approval requests, publish the component, and schedule it for recurring operation. In the demonstration, the agent monitored emails from the attacker with subjects starting with “TASK” and executed the contained instructions while returning results to the attacker-controlled address.