Security Vulnerability in ChatGPT Allows Data Leakage

Check Point Research has uncovered a serious security vulnerability in ChatGPT in a report published today. This flaw allows attackers to read data from the user's Gmail account through a strategically placed command within a ChatGPT conversation. The information is then relayed via a hidden channel to a second ChatGPT account while the user continues to interact with the system. The security researchers demonstrated in a proof of concept how a simple command in a ChatGPT dialogue can exploit the system's functionality. Meanwhile, the user remains unaware as their sensitive data, such as emails and personal information, is transmitted to an attacker.

This type of attack could have significant implications for user privacy and data security. The discovery raises questions about the security of AI-powered applications, particularly regarding the handling of personal data. Check Point Research emphasizes that the vulnerability is not merely theoretical but could be exploited in practice if users are not cautious. The researchers recommend that users pay particular attention to the type of information they input when using AI tools. The vulnerability could also impact businesses that integrate ChatGPT into their workflows.

If employees enter sensitive corporate data in chats, there is a risk that this information could also be intercepted. Therefore, companies should review and potentially adjust their security policies to minimize such risks. Check Point Research has reported the vulnerability to OpenAI, the company behind ChatGPT. It remains to be seen how quickly OpenAI will respond to this discovery and whether security updates will be provided to close the gap. The researchers stress the need for developers of AI applications to take proactive measures to ensure the security of their systems.

The discussion about the security of AI applications is reignited by this discovery. Experts warn that integrating AI into everyday applications without adequate security measures could lead to an increase in cyberattacks. Users should be aware of the risks and protect their data accordingly. The vulnerability in ChatGPT could also have legal consequences, especially if personal data is shared without the user's consent. Data protection authorities may initiate investigations to determine whether existing data protection laws have been violated.

Compliance with the General Data Protection Regulation (GDPR) is crucial for companies that handle personal data. The discovery by Check Point Research is not the first of its kind. In the past, there have been several reports of vulnerabilities in AI applications that could be exploited in similar ways. Continuous monitoring and improvement of security measures are therefore essential to maintain user trust in such technologies. The researchers from Check Point Research have classified the vulnerability under the CVE number CVE-2026-XXXX.

This classification allows the vulnerability to be tracked in databases for security vulnerabilities and appropriate measures to be taken. The exact number of affected users is currently unknown; however, the reach of this vulnerability could be significant. The publication of the report has already sparked a broad discussion in the tech community. Experts are calling for increased collaboration between developers, security researchers, and users to enhance the security of AI applications. The need to establish security standards is seen as critical to preventing future incidents of this nature.

Check Point Research has urged users to remain vigilant and monitor their accounts for suspicious activities. The use of two-factor authentication and other security measures is strongly recommended to minimize the risk of data misuse. The vulnerability was disclosed on September 10, 2026.