ChatGPT Flaw Let Attackers Extract Data From Other Users’ Sessions
Summary
Check Point Research found that a shared internal Artifactory service could let hidden instructions in shared chats or custom GPTs relay data from a victim’s ChatGPT session. OpenAI decommissioned the service; no in-the-wild exploitation is confirmed.
Key points
- Containers shared access to an internal JFrog Artifactory service whose metadata API allowed them to read and write shared properties.
- Researchers demonstrated using that shared metadata as a covert channel between separate ChatGPT sessions.
- An attacker could place hidden instructions in a shared conversation or custom GPT to make ChatGPT retrieve and relay data available in a victim’s session.
- Potentially exposed information included chat histories, uploaded files, and data from connected apps; researchers demonstrated retrieving private Gmail emails.
- The reported risk was greatest for users with connected external applications and who interacted with untrusted shared chats or custom GPTs.
- OpenAI confirmed it decommissioned the internal service. The article reports no confirmed malicious exploitation in the wild.
- The article recommends reviewing connected apps and changing low-risk action permissions to require approval.
Article Details
- Vulnerability Types
- Cross-account data leak
- Container isolation bypass
- Covert communication channel
- Severity
- Severe
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Change the default permission setting from “Allow low-risk actions” to “Always ask.”
- Review connected applications in ChatGPT settings.