The more access you give ChatGPT, the more an attacker can work with if they trick the AI into following the wrong instructions.
A new Check Point finding illustrated that risk by examining ChatGPT’s code-execution environment and connected apps. Researchers showed that a planted instruction could make a victim’s session perform a hidden task using its existing permissions and relay it to another ChatGPT account.
The attack did not require a stolen password or an attacker-controlled server to transfer the data. Instead, researchers found that supposedly isolated ChatGPT code-execution environments could exchange information through shared metadata in an internal package service, giving an attacker a covert channel for sending commands and receiving results.
How the attack unfolds
According to Check Point, an attacker could deliver the malicious instruction through any of these three methods:
- A user could paste a malicious prompt into a chat
- A user could open a shared conversation that already contained the instruction
- A user could use a custom GPT with the instruction hidden in its configuration.
Once the instruction was in place, the victim did not need to do anything unusual. A single ordinary message could cause ChatGPT to answer the user’s question while also carrying out a separate, hidden task for the attacker.
In Check Point’s proof of concept, the malicious instruction directed ChatGPT to check for attacker commands stored in metadata on an internal package service accessible to different code-execution environments. When the victim sent an ordinary message, ChatGPT answered the visible request while separately retrieving the hidden command, carrying it out, and returning the result through the same covert channel.
The amount of information an attacker could obtain depended on what the victim’s ChatGPT session was already allowed to access. In Check Point’s demonstration, ChatGPT retrieved email data from the victim’s connected Gmail account and relayed it to the attacker.
Something like this has happened before
This is not the first time researchers have shown how hidden instructions can make an AI agent leak information.
In September 2025, Radware demonstrated ShadowLeak, an attack in which a malicious email contained hidden instructions that caused ChatGPT’s Deep Research agent, when given access to Gmail, to retrieve sensitive information from the inbox and send it to an attacker-controlled server without the user’s knowledge.
The earlier attack relied on indirect prompt injection in which the malicious instructions were planted in content the AI was asked to read, rather than entered directly by the user. The Check Point research follows a related pattern but uses a different path to move the stolen information.
A seemingly unsolvable AI problem
Prompt injection has long been one of AI’s biggest security problems, and it works much like social engineering. Instead of breaking a system, an attacker tries to trick the AI into doing something it was not supposed to do.
OpenAI has acknowledged just how difficult that problem is, saying that “prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully solved.”
The reason is simple: prompt injection targets the same ability that makes AI useful — its ability to understand and follow instructions.
When an AI reads emails, webpages, or documents alongside a user’s request, an attacker can hide malicious instructions in that content and make them appear legitimate, making it difficult for the model to separate trusted instructions from malicious ones reliably.
Why you should care
The cross-account channel was no longer available when Check Point completed its report, and OpenAI confirmed that the internal Artifactory instance involved had been decommissioned. However, the research points to a broader risk as ChatGPT and other AI assistants gain access to more sensitive services. The bigger concern is what happens as ChatGPT and other AI assistants gain access to more of your digital life.
Email, files, workplace tools, and even entire devices are now being integrated into AI platforms. While this can make an AI more useful, it also creates more paths for attackers to exploit and gives them more incentive to keep using prompt injection.
For users and security teams, that means a malicious instruction can become a data-security incident without the attacker ever stealing a password. The more email, files, and workplace services an AI assistant can access, the more information it could potentially expose through an overlooked flaw.
The practical takeaway is to review which services are connected to your AI assistant, remove access you do not need, and enable stricter confirmation settings where available. OpenAI’s “Always ask” setting, for example, requires approval before a connected app performs an action. The fewer permissions an AI has, the less an attacker can potentially abuse if a prompt injection succeeds.
Users should also be cautious about interacting with shared chats, custom GPTs, and prompts from unknown sources. In Check Point’s shared-conversation scenario, the hidden task was activated after the victim opened the conversation and sent a message. Before interacting with unfamiliar AI content, check its source and consider what connected services the session can access.