ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0431

ACVE-2026-0431

ChatGPT with code containers and a connected Gmail account, during ordinary use, processed a hidden cross-account task and returned the victim's Gmail data to an attacker.

Exposure

Evidence
Demonstrated · researcher report
Harness
ChatGPT code containers with connected apps — confirmed, research.checkpoint.com
Model
any — unconfirmed
Goal
Any ordinary ChatGPT task in a session with connected apps (goal not stated by the source) — unconfirmed
Tools and settings
Code-execution containers and the connected Gmail app — confirmed, research.checkpoint.com
Approval
The hidden Gmail action completed without an approval opportunity in the visible conversation — confirmed, research.checkpoint.com
Input controlled by
content-author
What the agent does
ChatGPT performs a hidden task with the victim session's tools and connected data.
Harm
data-exfiltration
Reach
The victim's connected Gmail data — confirmed, research.checkpoint.com (the inbox)

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Severity
HIGH · harm and reach
Status
Unverified
Kind
Code
Source date
2026-09-08
Modified
2026-09-25
Aliases
No CVE assigned — No CVE was assigned in the public disclosure.
Affected
  • AgentHarness: chatgpt — all versions
Harness/product
chatgpt
Classes
data-exfiltration; prompt-injection-to-tool; over-privileged-combination; CWE-1427
Taxonomy
ASI: ASI01; ASI: ASI02; ATLAS: AML.T0051.001; ATLAS: AML.T0085.001
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

What

Check Point Research demonstrated a covert channel between ChatGPT sessions belonging to different accounts. A hidden instruction made the victim's session perform a second task using its connected apps while returning a normal visible answer; the proof of concept retrieved data from the victim's Gmail account and relayed it to the attacker.

Detection

Check Point Research reproduced the behavior in a proof of concept.

Fix

Review connected-app permissions and treat hidden instructions in shared conversations or custom GPTs as untrusted.

Fix

Limit connected-app access and inspect hidden instructions in shared ChatGPT contexts.

  • Reconfigure agent.connected-apps to least privilege. The demonstrated task used permissions already available to the victim session. Owner: operator
  • Reconfigure openai.chatgpt.codeContainers to isolated between accounts. Recommended: the leak ran through a channel between sessions of different accounts. Owner: harness-vendor
  • Reconfigure openai.chatgpt.connectedApps to actions shown in the visible conversation. Recommended: the Gmail action completed with no approval opportunity in the visible conversation. Owner: harness-vendor

References

REPORT

Report a problemJSON