Check Point Research found a covert cross-account command channel in ChatGPT that let an attacker run hidden tasks inside a victim’s session and receive the results across accounts. In a proof of concept, the technique was used to access data from a connected Gmail account and exfiltrate conversation content through shared internal Artifactory metadata. #ChatGPT #Gmail #JFrogArtifactory
Keypoints
- Check Point Research discovered a covert bidirectional channel between code-execution containers in separate ChatGPT accounts.
- The channel relied on a shared internal JFrog Artifactory service that both containers could reach, despite being otherwise isolated.
- Item properties in the Artifactory storage API were abused as a shared clipboard to pass data between accounts.
- A malicious instruction embedded in a shared conversation, prompt, or custom GPT could trigger hidden tasks alongside a victim’s normal request.
- The proof of concept showed ChatGPT retrieving email data from the victim’s connected Gmail account and sending it to the attacker.
- The same method could exfiltrate chat history and files from the affected conversation and code-execution environment.
- OpenAI confirmed the internal Artifactory instance identified during the research had been decommissioned.
MITRE Techniques
- [T1059.006] Command and Scripting Interpreter: Python – ChatGPT code-execution containers ran crafted code to access the storage endpoint and move data between environments (‘code launched by ChatGPT could therefore authenticate to the storage endpoint’).
- [T1213] Data from Information Repositories – The attacker used the victim’s connected Gmail account and conversation/files as sources of sensitive information (‘retrieve a list of emails’ and ‘exfiltrate conversation history and files’).
- [T1105] Ingress Tool Transfer – The environment allowed retrieval of dependencies from an internal Artifactory service, which the research showed could be leveraged as an internal transfer path (‘allowed to access an internal JFrog Artifactory instance’).
- [T1098] Account Manipulation – The attack depended on using the victim’s existing ChatGPT session, permissions, connected apps, and account context to perform actions as that session (‘using the capabilities of the victim’s session’).
- [T1539] Steal Web Session Cookie – The attacker did not steal cookies directly, but leveraged an existing authenticated ChatGPT session and its authorized access to connected apps (‘the victim’s ChatGPT session’).
- [T1021] Remote Services – The hidden task stream controlled actions through remotely connected services such as Gmail and other apps available to the victim session (‘connected Gmail account’ and ‘Gmail, Google Drive, Microsoft Teams, GitHub’).
Indicators of Compromise
- [Service/Platform] Covert cross-account communication path in ChatGPT – ChatGPT code-execution containers, shared internal JFrog Artifactory instance
- [API Endpoint] Storage metadata access used for cross-account data transfer – /api/storage/{repoKey}/{itemPath}
- [Property Name] Test metadata written to prove cross-account visibility – chatgpt_test_ts
- [Connected App] Data accessed during proof of concept – Gmail, Google Drive
- [Credentials/Runtime Artifact] Container-authentication material exposed to code – environment variables containing reader credentials