Affected Systems

ChatGPT users with connected apps (Gmail, other integrations) enabled. All account types affected, including Business, Enterprise, and Edu workspaces. Vulnerability existed in ChatGPT's internal JFrog Artifactory service used for Python/npm package management. OpenAI confirmed the vulnerable service has been taken offline; no CVE assigned.

Exploitation Status

Proof of concept demonstrated by Check Point Research in June 2026. No evidence of active exploitation in the wild. OpenAI confirmed the vulnerable internal service has been disabled. The attack required planting a malicious prompt instruction via shared conversations, custom GPTs, or user-pasted content.

Business Impact

Organizations using ChatGPT with connected apps (Gmail, third-party integrations) faced risk of covert data exfiltration. The vulnerability allowed cross-account communication between isolated ChatGPT containers via metadata properties in an internal package repository. Attackers could read Gmail contents, chat history, and files without user consent or visible indication beyond a small "Talked to Gmail" label. Default "Important actions" permission setting allowed reads without prompting users. Enterprise/Business admins had limited visibility into this abuse vector. No user action required for remediation as OpenAI disabled the vulnerable service.

Urgency

🟡 Within a week

Recommended Actions

  • Verify ChatGPT connected apps are configured with 'Always ask' permission instead of default 'Important actions' in user settings to require explicit approval for all app interactions
  • Enterprise and Edu admins should review workspace app permissions and restrict which connected apps are available to users, particularly those with access to sensitive data like Gmail
  • Audit ChatGPT usage logs for unexpected 'Talked to Gmail' or other app interaction labels during June-September 2026 timeframe to identify potential unauthorized data access
  • Educate users not to paste untrusted prompts, open shared ChatGPT conversations from unknown sources, or use unvetted custom GPTs that could contain hidden instructions
  • Monitor OpenAI security advisories for additional details on timeline and scope, and review any shared conversations or custom GPTs created during the vulnerable period