Hidden ChatGPT Channel Exfiltrates Connected App Data via Internal Microservices

Check Point Research disclosed a critical isolation flaw in ChatGPT's architecture that allowed attackers to covertly execute unauthorized tasks and exfiltrate sensitive data from connected applications, such as Gmail. The exploit leveraged an indirect prompt injection delivered via a shared conversation, custom GPT, or pasted prompt. When the victim interacted with the assistant normally, ChatGPT processed the user's intended prompt while concurrently executing a hidden, attacker-directed payload in a background stream during "Thinking mode". The system subsequently exfiltrated user data across tenant boundaries by abusing a shared internal JFrog Artifactory instance—using its metadata properties as an ad-hoc, bidirectional cross-account communication channel. This discovery is a stark wake-up call for application security engineers managing enterprise AI integrations. Modern conversational AI systems are no longer isolated text generators; they operate as authenticated execution environments equipped with code sandboxes and extensive read/write permissions to SaaS ecosystems, including Google Workspace, Microsoft 365, and GitHub. Because ChatGPT defaulted to executing read actions without explicit confirmation prompts, attackers could silently compromise high-value user context without altering the visible chat response or raising alarms. The only visible artifact was a subtle metadata badge indicating that the tool had been accessed after the read had already completed. Architecturally, this flaw highlights the persistent risk of covert channel communication in multi-tenant cloud environments. While the individual code execution containers lacked public internet access and direct inter-container routing, both containers maintained legitimate read and write access to internal package storage APIs. By turning storage metadata properties into a shared clipboard, attackers bypassed tenant isolation without ever breaching network perimeter controls. This reinforces a well-known systems security reality: application isolation boundaries fail when shared backing microservices allow ambient, unpartitioned state exchange across separate trust domains. For DevSecOps and AppSec practitioners, this incident mandates immediate operational adjustments. First, organizations deploying AI agents and assistants must enforce explicit human-in-the-loop approvals for all external tool and API interactions, rather than relying on vendor default permissions that treat read operations as benign. Second, teams building agentic systems must establish strict capability-based access control and strictly partition internal backend services, ensuring that sandboxed execution runtimes cannot write metadata accessible across distinct user identities. Finally, security teams must monitor autonomous LLM tool executions through structured API auditing to catch unexpected data retrieval patterns in real time.