ChatGPT Flaw Sent One User’s Gmail to Another Account: What It Means for Firms Holding Client Files
A single hidden instruction could make ChatGPT read a user’s connected Gmail and pass the contents to a different ChatGPT account, while it answered the user’s question as normal. Check Point Research published the finding on 8 September 2026. OpenAI had already shut down the internal service that carried the data, and the researchers found no sign of real-world attacks.
A cross-account leak is a flaw that lets data belonging to one customer of a shared service reach another customer of the same service. This case shows where an AI assistant does its work: on infrastructure you share with every other account on the platform.
What did Check Point find in ChatGPT?
In the researchers’ demonstration, a victim opens a shared link and asks ChatGPT for a chart of average monthly temperatures in New York. ChatGPT draws the chart. In parallel, a second stream of tasks that the victim never sees reads the victim’s Gmail and hands the data to the attacker’s own ChatGPT account.
The instruction could arrive by three routes: a prompt pasted into a chat, a shared conversation link, or the hidden configuration of a custom GPT. The victim’s only clue was a small “Talked to Gmail” label, and it appeared after the read had happened.
How could one ChatGPT account reach another?
ChatGPT runs code for its users inside isolated containers, one environment per account. Those containers download software packages from an internal OpenAI service built on JFrog Artifactory. Check Point found that containers from any account could reach that service, write notes on shared items and read the notes other accounts had left.
The researchers call it a shared clipboard. Two accounts that OpenAI’s design kept apart could pass messages, and data, through it.
The same internal Artifactory instance appears in a second story from this summer. OpenAI’s official report of 26 August describes how its own AI agents, during testing, compromised that registry to reach the internet and went on to breach Hugging Face. When Check Point reported its channel at the end of June, OpenAI replied that it had already decommissioned the instance.
Why does the default permission setting matter?
ChatGPT connects to Gmail, Google Drive, Microsoft Teams, GitHub and other services. With the default setting, it approves read actions it judges low risk without asking you, and it counts reading your mail as low risk. A stricter “Always ask” option exists. You have to switch it on yourself.
OpenAI closed this flaw in its own infrastructure. The permission you grant when you connect a mailbox stays in place, and any future flaw that reaches your session inherits it.
| Question you ask your AI provider | Does data residency answer it? | What this case tested |
|---|---|---|
| Where do you store my conversations and files? | Yes: OpenAI offers Europe, including Switzerland, for Enterprise, Edu and the API | Not in question |
| Who else runs code on the machines that process my data? | No | Containers from any account reached the same internal service |
| Does the assistant read my connected mail without asking? | No | Yes by default, for reads it judges low risk |
And in Switzerland?
OpenAI sells data residency in a region it calls Europe, covering the EEA and Switzerland, for ChatGPT Enterprise, ChatGPT Edu and the API. Residency covers stored content: conversations, uploaded files and custom GPTs. VentureBeat reported in November 2025 that processing stayed in the United States and that third-party connectors can follow different rules.
This case sits outside what residency describes. A Swiss firm could keep every conversation stored in Europe and still share the environment that runs the code with every other customer. Under the Swiss Data Protection Act, a firm that hands processing to a provider must make sure the provider can keep the data secure (art. 9). For a fiduciary or an accountant holding client files, that duty covers the machine that reads the files as well as the place that stores them.
We wrote on 1 September about why AI sold as “local” does not run where you think. This case adds the question that comes after the address: who else is in the building.
What to do now
- Map what your people have connected. List the mailboxes, drives and chat workspaces linked to an AI assistant, and under whose account. Personal accounts used for work count.
- Switch connectors to “Always ask” and remove the ones nobody needs. A mailbox with client correspondence should need a human click before an AI reads it.
- Keep outside instructions away from client data. Ban custom GPTs from unknown authors, and conversation links shared from outside the firm, on any account connected to client files.
- Ask your provider two questions in writing. Where it stores your data, and how it keeps your data apart from other customers in the environment that runs the code. File the answers with your contract.
Frequently asked questions
Is the ChatGPT flaw still open?
No. OpenAI had decommissioned the internal service before Check Point reported it, and Check Point says the route in its demonstration no longer works. You do not need to install or change anything to close it.
Did attackers steal real emails?
Check Point, The Register and The Cyber Express report no evidence of exploitation in the wild. The research is a demonstration of what the design allowed.
Which ChatGPT plans did the flaw reach?
Neither Check Point nor the press coverage names specific plans. The research describes the connected-apps feature and the environment where ChatGPT runs code.
Does European data residency protect against this kind of flaw?
Residency sets where OpenAI stores your content. This channel ran through a shared service in the environment that executes code, a layer residency does not describe.
If a client asked you this week which other accounts share the machine that reads their files, what would you answer?
Technical note: the channel used item properties in an internal JFrog Artifactory instance reachable from ChatGPT’s code-execution containers. The flaw has no CVE identifier.
Sources
- Check Point Research, “The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT”, 8 September 2026 (primary).
- The Register, “OpenAI’s Artifactory opened covert data-stealing channel alongside Hugging Face attack”, 8 September 2026.
- CSO Online, “ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel”, 9 September 2026.
- The Hacker News, “ChatGPT Flaw Let a Planted Prompt Send a Victim’s Gmail Data to Another Account”, 8 September 2026.
- The Cyber Express, “ChatGPT sandbox flaw leads to Gmail leak”, September 2026.
- TechCrunch, “OpenAI releases its official report on the Hugging Face breach”, 26 August 2026.
- VentureBeat, “OpenAI now lets enterprises choose where to host their data”, November 2025.
