Researchers Uncover ChatGPT Isolation Bug That Could Exfiltrate Linked Gmail Data

Security analysts have identified a recently fixed vulnerability in OpenAI's ChatGPT platform that could have allowed malicious actors to siphon information from a user's connected Gmail account and relay it to a different ChatGPT user through a concealed cross‑account channel.

The flaw stemmed from an oversight in the service's isolation mechanisms, which are designed to keep each user's data separate. By exploiting a hidden communication path, an attacker could trigger the model to retrieve emails from a victim's linked Gmail mailbox and forward the content to an attacker‑controlled ChatGPT session, bypassing the usual safeguards that prevent one account from accessing another's data.

While the issue required the victim to have previously granted ChatGPT permission to access their Gmail, the potential consequences were significant. Unauthorized access could expose personal correspondence, sensitive attachments, and other private information, raising concerns for both individual users and enterprises that rely on AI‑assisted email handling.

OpenAI responded promptly after the vulnerability was reported, issuing a patch that closes the cross‑account conduit and reinforces the isolation layer. The company also urged users who had linked Gmail accounts to review their permissions and monitor for any unusual activity, recommending the revocation and re‑granting of access as a precaution.

The discovery adds to a growing list of security challenges associated with large language models that integrate with third‑party services. As AI tools become more deeply embedded in everyday workflows—ranging from drafting messages to automating data extraction—ensuring robust compartmentalization of user data is becoming a critical priority for developers and regulators alike.

Industry observers note that the incident underscores the need for continuous security auditing of AI platforms, especially those that handle privileged connections such as email, cloud storage, and corporate APIs. Future safeguards may include stricter permission scopes, real‑time monitoring of cross‑session interactions, and more transparent disclosure processes to keep users informed of emerging risks.