A ChatGPT proof of concept showed how prompt injection could secretly access connected Gmail data and transfer it across accounts without compromising the victim’s endpoint.
The attack combined malicious instructions, legitimate connector permissions, and a covert channel in shared infrastructure, showing how AI integrations can expand enterprise data exposure.
Organizations should govern AI connectors as privileged integrations, minimize permissions, remove unnecessary connections, and monitor connector and SaaS activity.
Hexnode UEM, IdP, and XDR can strengthen surrounding device, access, and endpoint controls, but prompt-only data transfers still require dedicated connector governance and least-privilege access.
A planted prompt could cause an AI assistant to perform a hidden second task. It could read connected Gmail data while returning a normal answer to the user.
Check Point Research demonstrated this AI assistant vulnerability in a proof of concept involving two ChatGPT accounts. The technique combined prompt injection with a covert channel between code-execution environments. It did not require malware on the victim’s endpoint.
The research highlights a growing enterprise risk. AI assistants can access far more data when organizations connect them to email, cloud storage, collaboration tools and development platforms.
The attack began with a malicious instruction planted inside a ChatGPT conversation. A victim could introduce it by pasting a crafted prompt, opening a shared conversation or using a custom GPT containing hidden builder instructions.
The instruction told ChatGPT to process two separate request streams. One handled the victim’s visible request. The second checked for tasks supplied by an attacker.
The flaw abused metadata properties exposed through the Item Management API within the internal JFrog Artifactory instance. The service did not segregate this package metadata between accounts. One container could write information that another account’s container could retrieve. This unsegregated metadata effectively became a “shared clipboard” between otherwise isolated environments.
This behavior turned the internal package service into a cross-account clipboard. Attackers could encode data, divide larger content into chunks and transfer it through the shared metadata.
Featured Resource
Cybersecurity kit
Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.
The hidden task operated with the tools and permissions available to the victim’s ChatGPT session. In Check Point’s demonstration, the victim had connected Gmail to ChatGPT.
When the victim submitted an ordinary request, ChatGPT answered it normally. At the same time, the hidden instruction directed the assistant to retrieve email data and relay it through the covert channel.
The visible response did not mention the hidden request or the transferred information. Check Point observed only a small “Talked to Gmail” label after the connector had already accessed the account.
The researchers said the channel could also expose conversation history and files available within the affected chat or code-execution environment. Its reach depended on the victim’s connected applications, accessible data and existing permissions.
This was a researcher-developed proof of concept, not evidence of widespread exploitation. OpenAI confirmed that it decommissioned the internal Artifactory service behind the channel. Users did not need to install an update, according to Check Point Research.
Why does this matter for enterprise AI security?
This vulnerability did not depend on a conventional endpoint compromise. It combined malicious instructions, legitimate connector permissions and weak isolation within shared infrastructure.
That distinction matters for security teams. An AI assistant may access Gmail, Google Drive, Microsoft Teams, GitHub or other services without deploying malicious software. Existing endpoint controls may therefore see no suspicious executable or obvious malware alert.
Organizations should treat AI connectors as privileged integrations. Each connector expands the data available to the assistant and increases the potential impact of prompt injection.
Security teams should inventory approved AI services and connected applications. They should also remove unnecessary connectors, minimize granted permissions and review connector activity. OpenAI recommends limiting an agent’s access and carefully reviewing requested actions to reduce prompt-injection risk.
UEM can strengthen device posture, but it cannot revoke SaaS connector permissions at the tenant level. Security teams should also implement SaaS Security Posture Management (SSPM) or Google Workspace and Microsoft 365 OAuth app restrictions. These controls can identify, restrict or revoke over-privileged AI connectors before they expose business data.
How can Hexnode strengthen the surrounding security controls?
Hexnode cannot remediate a vulnerability inside ChatGPT’s infrastructure or directly inspect every action performed through a Gmail connector. However, its endpoint, device and access controls can reduce the surrounding enterprise risk.
Hexnode UEM can help administrators manage approved applications, configure supported browser settings and extensions, enforce operating-system updates and evaluate device compliance. These controls help limit access to enterprise AI services from unmanaged or outdated endpoints.
Hexnode IdP can apply conditional access requirements based on user, device and access context. Organizations can use these controls to restrict sensitive applications to trusted, managed and compliant devices.
Hexnode XDR provides endpoint visibility and threat-hunting capabilities for Windows and macOS environments. If an AI-assisted attack also introduces suspicious processes, scripts or files, analysts can investigate the endpoint activity. They can then isolate the device, kill a malicious process or quarantine a file.
However, a prompt-only data transfer may not produce those endpoint indicators. Organizations must combine these controls with connector governance, SaaS audit logs and least-privilege access.
FAQs
How can prompt injection expose data from connected AI applications?
Prompt injection can introduce hidden instructions that cause an AI assistant to use tools or permissions available in the victim’s session. If the assistant has access to connected services such as email or cloud storage, those permissions can increase the amount of data potentially exposed.
Can an AI assistant leak enterprise data without malware on the endpoint?
Yes. The demonstrated attack relied on malicious instructions, legitimate connector permissions and a covert channel rather than malware installed on the victim’s device. This means traditional endpoint malware detection alone may not identify a prompt-driven data transfer.
Why should enterprises treat AI connectors as privileged integrations?
AI connectors can give assistants access to sensitive services such as email, cloud storage, collaboration platforms and development tools. Organizations should therefore limit connector permissions, remove unnecessary integrations and monitor connector activity to reduce the impact of prompt injection.
Governing AI assistants as part of the data plane
Connected AI assistants now operate within the enterprise data plane. Their permissions can expose email, files, source code and collaboration records to prompt-driven abuse.
Organizations should govern AI connectors, restrict permissions and monitor application access. They should also control which devices and identities can reach sensitive AI workflows. Layered governance reduces the damage when an AI assistant vulnerability bypasses traditional endpoint defenses.
Strengthen Enterprise AI App Security
Govern AI-connected endpoints, detect suspicious activity, and strengthen threat response with Hexnode UEM and XDR.
Content writer at Hexnode. Fueled by good coffee and the occasional cat cuddle, I enjoy crafting content that informs, connects, and resonates. Nothing excites me more than knowing my words have been read, appreciated, and maybe even bookmarked.
