ChatGPT Artifactory Flaw Enabled Silent Cross-Session Data Theft from Gmail and GitHub

What happened

Why it matters

• ·Enterprises that have granted ChatGPT or similar AI tools OAuth access to productivity platforms such as Gmail, Google Drive, and GitHub should audit those permission grants immediately: this research demonstrates that session isolation failures can convert legitimate credentials into an exfiltration mechanism with no visible signal to the victim or to standard DLP tooling.
• ·The 'coerced insider' attack model sits outside the detection envelope of most existing perimeter and behavioral controls, because the exfiltrating entity is the AI acting on legitimate credentials rather than a compromised human account. This creates a direct gap in UEBA, CASB, and DLP programs that classify AI-mediated actions as trusted user activity.
• ·For organizations subject to data protection regimes including financial services regulators and health sector rules, cross-session leakage of regulated data through a vendor platform constitutes a reportable incident even though no malicious actor touched the data directly. Vendor contracts and incident notification clauses must address AI-platform-mediated data exposure, not only traditional breach scenarios.

Governance controls affected

What to do now

• ☐Audit all active OAuth grants between ChatGPT, similar AI platforms, and enterprise SaaS services (Gmail, Google Drive, Microsoft Teams, GitHub), and revoke any grants that are broader than the minimum required for documented use cases.
• ☐Review vendor security attestations and penetration-testing documentation for AI platforms with access to corporate SaaS environments, specifically requesting evidence of cross-session isolation controls and container boundary testing.
• ☐Classify AI-platform-mediated data access within your incident response playbook as a distinct attack surface, and confirm that UEBA and DLP tooling can detect anomalous outbound data flows originating from AI service accounts rather than human accounts.
• ☐Update AI vendor contracts to include explicit incident notification obligations covering cross-tenant or cross-session data exposure, not only traditional unauthorized-access breach definitions.
• ☐Escalate the 'coerced insider' threat model to the security operations team for inclusion in the next tabletop exercise, using this disclosure as the scenario basis for testing detection and containment capabilities.

What to watch next

Check Point Research has indicated this disclosure is connected to a parallel Hugging Face attack surface investigation, and further technical details are expected as coordinated disclosure progresses with OpenAI. Compliance teams should monitor whether OpenAI issues a formal incident report or customer notification, and whether the EU Digital Services Act, AI and Algorithmic Accountability Provisions or applicable data protection authorities treat this as a notifiable cross-platform data breach. The broader pattern of AI-platform session isolation failures seen in the CoSnitch and ASCII smuggling findings suggests regulators are building an evidentiary record that will inform forthcoming guidance on AI platform security requirements for enterprise deployers.