The Permission Was Valid. The Requester Wasn’t.

A valid permission does not establish that every request using that permission is authorized.

Check Point Research disclosed a controlled proof of concept in September 2026 showing that code-execution containers associated with different ChatGPT accounts could exchange data indirectly through mutable metadata on a shared internal service. Researchers demonstrated an attacker planting a hidden task that caused another user’s ChatGPT session to access its connected Gmail account and relay information through the covert channel while still returning a normal visible answer to the victim.

OpenAI had decommissioned the affected shared service by the time the research was published. The report does not establish known in-the-wild exploitation.

The connector permission was real

The victim had legitimately authorized ChatGPT to access Gmail. At the capability layer, the read action could therefore appear valid.

But institutional authority asks a different question: who caused this particular action, for what purpose, and under which instruction lineage?

The demonstrated attack separated capability from purpose. The system could establish that the session was allowed to read Gmail, but the initiating instruction originated from another principal.

Permission is not delegated authority

GovKM maps the expected relationship as Authority / user → Context / visible task → Decision → Action / connected-app read. The demonstrated path instead introduced an attacker-controlled instruction into the victim runtime and reused the victim’s authentic connector authority.

The capability remained valid. The authority lineage did not.

This is why RBAC, OAuth scopes, connector permissions, and service accounts are necessary but insufficient for consequential agents. They establish capability. They do not necessarily establish whether a particular action is institutionally authorized for the present purpose.

Instruction lineage should survive to execution

A continuity-aware runtime should preserve the relationship among the sponsoring authority, active purpose, admitted instructions, delegated scope, and resulting action. If an instruction cannot be traced to an authorized principal and mission state, the agent should not inherit someone else’s connector authority merely because the technical permission exists.

GovKM interprets the research as a strong demonstration of the principle: the permission can be valid while the requester is not.

Sources

Alexey Bukhteyev, Check Point Research, “The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT,” September 8, 2026. https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/

Check Point, “ChatGPT Let Attackers Read Victims’ Gmail Through a Hidden Channel Between Accounts,” September 8, 2026. https://blog.checkpoint.com/research/chatgpt-let-attackers-read-victims-gmail-through-a-hidden-channel-between-accounts/