A Hidden Message in ChatGPT Could Quietly Steal Your Gmail, Researchers Show
Check Point Research demonstrated how one poisoned instruction can turn the assistant into a silent courier for a victim's inbox.
Key points
- Check Point Research published a proof of concept showing ChatGPT can be tricked into secretly leaking data from a user's connected Gmail account.
- The attack works by planting a hidden instruction in a ChatGPT conversation, a technique known as prompt injection.
- In the demo, ChatGPT answered the victim's question normally while sending inbox data to a second ChatGPT account through a covert channel.
- The risk sits with any AI assistant wired into personal accounts through connectors or plugins, not just ChatGPT.
- Users can't see the theft happening, because the assistant's visible reply looks entirely normal.
A new proof of concept from Check Point Research, first written up by The Hacker News, shows how a single sneaky instruction can turn ChatGPT into a quiet spy for whoever planted it.
The target is your Gmail, if you've connected it to the assistant. Check Point published this report on 12 September 2026, the same day we noted the company's JSCeal malware research pulling apart stealthy credential theft from browser sessions.
The technique is called prompt injection: if an attacker can slip text into something ChatGPT reads (a document, a webpage, an email the assistant is asked to summarize), that text can contain hidden orders the model will obey as if the user typed them.
What did the researchers actually do?
They built a demo where ChatGPT, while answering a user's ordinary question, also carried out a second hidden task. That task read data from the user's linked Gmail account and passed it to a separate ChatGPT account controlled by the attacker. The victim saw a normal answer on screen. Behind it, their inbox was leaking.
The attacker never touches the victim's machine. The assistant does the carrying itself.
How could a stranger plant instructions in my chat?
You wouldn't paste them in yourself. The instructions ride inside content the assistant processes on your behalf: a shared document, a webpage the assistant fetches, a calendar invite. Anywhere the model reads text it didn't write, an attacker can hide orders in that text.
Most users have no way to see what the assistant is actually being told, only what it shows back.
Is my Gmail already being stolen?
No evidence points to this being used against real users. It's a lab demonstration, not a live breach. The failure mode is the design pattern itself, and it applies to any AI assistant plugged into personal accounts through connectors or plugins.
| Detail | What Check Point showed |
|---|---|
| Attack type | Prompt injection through hidden instructions |
| Target data | Content from a connected Gmail account |
| Exfiltration route | A covert channel to a second ChatGPT account |
| Visible to the user? | No, the normal reply hides the theft |
| Vendor affected | OpenAI's ChatGPT, though the pattern is industry-wide |
Should you worry about your connected accounts?
Be picky about what you connect. Every integration you switch on (Gmail, Drive, a work mailbox) widens the blast radius if the assistant is ever tricked. Turn off connectors you don't actively use. If you ask an AI tool to summarize an email from an unknown sender, treat the result with the same suspicion you'd give the sender.
Watch your Google account activity page for sign-ins and app permissions you don't recognize, and revoke any you can't place.
For businesses, the postmortem will say something familiar when this pattern hits production: the AI connector had access to more mailboxes than anyone reviewed, and nobody was logging what the assistant read.
This is the thing worth watching here: ChatGPT's connector model hands the assistant read access to accounts containing years of private correspondence, and the permissions review most teams do is nowhere near thorough enough. Scope that access down now, before a real attacker finds the same path Check Point's researchers just mapped.
