ChatGPT agents could read Gmail messages pulled from a completely different person's account, thanks to a flaw researchers are calling a coerced insider.
According to Check Point Research, when ChatGPT spins up a sandboxed container to run code, it routes package downloads through an internal JFrog Artifactory service that every user's containers share. That service let one container write metadata another account's container could read back moments later, turning routine package-delivery logs into a clipboard shared across accounts that were supposed to be walled off. An attacker could leave malicious instructions in that shared space, then get a victim's ChatGPT session to check it during an otherwise ordinary reply, triggering a standard prompt injection without ever contacting the victim directly. In Check Point's demonstration, the agent pulled data from the victim's connected Gmail account and handed it to the attacker's session within a single conversational turn.
This isn't a jailbreak or a coding bug. It's what happens when you give one AI agent broad access to email, Drive, and GitHub, then assume account isolation holds all the way down the infrastructure stack. OpenAI closed this specific path after Check Point's disclosure, but the firm warns the same shared-service pattern could exist anywhere an AI agent runs code and touches connected accounts inside a trust boundary.
It's a reminder that an agent is only as trustworthy as the plumbing underneath it, and right now almost nobody outside the vendor can audit that plumbing.