A ChatGPT isolation flaw exposed the risk of connected data

The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.

Check Point Research demonstrated a communication channel between separate ChatGPT accounts through a shared internal service. Combined with a planted instruction, it could be used to retrieve data through the victim session’s capabilities, including connected email.

The researchers say the channel was no longer available when their report was completed, and OpenAI confirmed that the internal service had been retired. This was a disclosed research demonstration, not evidence that every connected mailbox had been accessed.

Reading data is a consequential action

A connector that can read mail or documents gives an assistant more information than the user types into the conversation. That is useful for legitimate work. It also means the scope of a manipulated request can extend beyond the visible prompt.

We recommend reviewing connections by account and purpose. Which corporate data is available to the assistant? Does the account need all of it? What is the process for withdrawing access?

Read permission should be included in that review. A system does not need the ability to edit a record for disclosure of the record to matter.

Make the boundary visible

Keep company connections in an arrangement the organisation can administer. Check current approval settings and activity records in the product, and make sure staff understand what a connected assistant can retrieve.

Where a task only needs a small set of documents, consider whether access can be limited to that set. Review unused connections and remove ones with no current purpose.

The particular channel in this report was closed. The broader lesson survives the fix: assess an assistant by the information and actions available to its session. Our Shadow AI explainer covers why the account and its connections belong in the inventory.