A Hidden Message in ChatGPT Could Quietly Steal Your Gmail, Researchers Show
Check Point Research demonstrated how one poisoned instruction can turn the assistant into a silent courier for a victim's inbox.
Key points
- Check Point Research published a proof of concept showing ChatGPT can be tricked into secretly leaking data from a user's connected Gmail account.
- The attack works by planting a hidden instruction in a ChatGPT conversation, a technique known as prompt injection.
- In the demo, ChatGPT answered the victim's question normally while sending inbox data to a second ChatGPT account through a covert channel.
- The risk sits with any AI assistant wired into personal accounts through connectors or plugins, not just ChatGPT.
- Users cannot see the theft happening, because the assistant's visible reply looks entirely normal.
A new proof of concept from Check Point Research, first written up by The Hacker News, shows how a single sneaky instruction can turn ChatGPT into a quiet spy for whoever planted it.
The target: your Gmail, if you have connected it to the assistant.
The trick is called prompt injection. That is a fancy name for a simple idea. If an attacker can slip text into something ChatGPT reads (a document, a webpage, an email the assistant is asked to summarise), that text can contain hidden orders the model will obey as if the user typed them.
What did the researchers actually do?
They built a demo where ChatGPT, while answering a user's ordinary question, also carried out a second, hidden task. That task read data from the user's linked Gmail account and passed it to a separate ChatGPT account controlled by the attacker. The victim saw a normal answer on screen. Behind it, their inbox was leaking.
The hidden channel is the clever part. The attacker never needs to touch the victim's machine. The assistant itself does the carrying.
How could a stranger plant instructions in my chat?
You would not paste them in yourself. The instructions ride along inside content the assistant is asked to process on your behalf. Think of an email you tell ChatGPT to summarise, a shared document, a webpage the assistant fetches, or a calendar invite. Anywhere the model reads text it did not write, an attacker can hide orders in that text.
In practice, most users have no way to see what the assistant is actually being told, only what it shows back.
Is my Gmail already being stolen?
No evidence points to this being used against real users. It is a lab demonstration, not a live breach. The failure mode here is the design pattern, not a one-off bug, and it applies to any AI assistant plugged into your personal accounts through connectors, plugins or integrations.
| Detail | What Check Point showed |
|---|---|
| Attack type | Prompt injection through hidden instructions |
| Target data | Content from a connected Gmail account |
| Exfiltration route | A covert channel to a second ChatGPT account |
| Visible to the user? | No, the normal reply hides the theft |
| Vendor affected | OpenAI's ChatGPT, though the pattern is industry-wide |
What should ordinary users do?
Be picky about what you connect. Every integration you switch on (Gmail, Drive, calendar, a work mailbox) widens the blast radius if the assistant is ever tricked. Turn off connectors you do not actively use. If you ask an AI tool to summarise an email or a document from an unknown sender, treat the result with the same suspicion you would give the sender.
Watch your Google account activity page for sign-ins and app permissions you do not recognise, and revoke any you cannot place.
For businesses, one thing the post-mortem will say when this pattern hits production: the AI connector had access to more mailboxes than anyone reviewed, and nobody was logging what the assistant read.
Operational takeaway: if your AI assistant can reach your inbox, assume any text it processes could be an instruction, and scope its access accordingly.
