ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account
- ID
- 22434
- Status
- summarized
- Published
- 08 Sep 2026, 10:19 PM
- Fetched
- 09 Sep 2026, 12:33 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/chatgpt-flaw-let-planted-prompt-send.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.5
- Created
- 09 Sep 2026, 12:35 AM
- Tags
- Audience
- developersai_agent_usersvibe_coders
What happened
Check Point Research demonstrated that a planted prompt in a ChatGPT conversation could silently exfiltrate data from a user's connected Gmail account to an attacker's ChatGPT account. The exploit uses ChatGPT's Thinking mode to run a hidden work stream alongside the visible answer, and relies on the default 'Important actions' permission which lets ChatGPT read from connected apps without prompting the user.
Why it matters
If you build or use custom GPTs or connect external apps (Gmail, Drive, etc.) to ChatGPT, you should switch connected-app permissions from 'Important actions' to 'Always ask' and treat shared conversations and custom GPT builder instructions as untrusted input. This is especially relevant for anyone shipping agent-based products that chain tools with default permissive permissions.
Discussion angle
The default permission model for connected apps assumes reads are safe—but for agents that can chain reads with hidden communication channels, a silent read is already a data breach. What permission defaults should agent platforms ship with instead?