A closed ChatGPT vulnerability underscores the importance of enforcing least privilege, approval requirements, activity monitoring and distrust of imported instructions

A now-closed ChatGPT vulnerability shows why organizations need to control what AI assistants can access and monitor what they do — not merely what they tell users.

Security teams should treat AI assistants with connected applications as privileged users. A flaw documented by Check Point Research (CPR) had allowed separate ChatGPT accounts to exchange commands and data through shared internal infrastructure, demonstrating how an attacker could exploit permissions already granted to a victim’s session.

CPR’s proof of concept method retrieved information from a victim’s connected Gmail account after the victim had opened a prepared shared conversation and sent an ordinary message. The victim had then received a normal-looking response; the only visible indication of the additional activity was a “Talked to Gmail” label shown after the read had occurred.

Researchers said malicious instructions could also have arrived through a prompt pasted into a chat or a custom GPT containing hidden instructions. They had discovered the issue in June 2026 and reported that OpenAI subsequently confirmed that the affected JFrog Artifactory instance had been decommissioned, closing this particular channel.

There is no indication in the published research that attackers exploited the vulnerability against real users. Nevertheless, the technique highlights several defensive priorities for organizations deploying AI tools:

• Map AI connections
  • Maintain an inventory of approved AI services, user accounts and connected applications. This should include OAuth authorizations, custom GPTs or plugins, service accounts and AI features embedded in existing enterprise software.
  • Pay particular attention to connections involving email, file storage, source-code repositories and collaboration platforms. The possible impact of CPR’s technique depended on what the victim’s session was already authorized to access; it did not independently grant ChatGPT additional permissions.
• Reduce standing access
  • Apply least privilege to AI assistants as rigorously as to employees and service accounts. Limit each connection to the smallest practical set of data, repositories and actions, and remove access when it is no longer required.
  • Where possible, use dedicated accounts or segregated data stores rather than connecting an assistant to a user’s entire mailbox or drive. OpenAI has noted that changing ChatGPT’s approval settings does not reduce the underlying access granted to an app; administrators must disable or disconnect the app to revoke that access.
• Require approval
  • Configure AI assistants to request approval before accessing sensitive information, including read-only operations. Reads are not inherently low risk when an attacker can influence the query or its destination.
  • ChatGPT’s available app-permission options can include “Always ask”, “Allow read actions” and “Allow low-risk actions”, depending on the app and workspace configuration. Organizations should use stricter settings for high-value data, and test whether approval controls apply consistently across normal chats, shared conversations, custom assistants and automated tasks.
• Distrust imported instructions
  • Treat shared chats, copied prompts, uploaded documents and third-party custom assistants as untrusted content. Any of them may contain instructions designed to manipulate an AI system without making the malicious objective clear to the user.
  • User education can reduce exposure, but it should not be the primary control. Organizations should restrict unapproved custom assistants, inspect externally supplied configurations where possible and avoid assuming that a normal-looking answer means the assistant performed only the visible task.
• Monitor actions, not answers
  • Log app calls, data retrieval, code execution and other tool use independently of the assistant’s conversational output.
  • Alert on unusual access patterns, such as an unrelated user request triggering mailbox searches or large file reads. Enterprise ChatGPT app calls are available through OpenAI’s compliance logging capabilities, but organizations should also correlate AI activity with identity, application and data-loss-prevention telemetry.
  • Platform operators, meanwhile, should ensure that mutable resources in shared internal services are tenant-isolated and inaccessible unless required.

The broader lesson of these tips is that an AI assistant’s effective privilege comprises every credential, application and internal service it can use. Security controls must therefore constrain and observe its actions even when its visible response appears harmless.