San Francisco, 18 September 2025 — OpenAI has patched a serious security flaw in ChatGPT’s connector system that could have allowed malicious actors to access a user’s Gmail data when certain integrations were enabled. The vulnerability, discovered by security researchers, exploited the interaction between ChatGPT’s Gmail and Google Calendar connectors, enabling what’s known as “indirect prompt injection.”
The potential breach stemmed from how ChatGPT reads and processes data from connected services once users authorize those connections. Researchers found that a malicious Google Calendar invite or a single “poisoned” document shared via Google Drive could embed hidden instructions which ChatGPT, under its old system, might follow. If triggered by a user request (e.g. “What’s on my calendar?”), the assistant could expose or search through Gmail content linked to that account.
OpenAI has since implemented mitigations to stop such attacks. According to the reports, the company has added safer defaults, tightened policy controls around how connectors use external data, and improved detection for disguised or embedded malicious prompts. Users are encouraged to review their settings and disable or limit access for connected services if they do not wish to risk exposure.
While no widespread data loss has been publicly confirmed, the vulnerability shines a light on the risks of giving AI systems deep access to personal accounts. It underscores how convenience—through integrations with Gmail, Google Drive, Calendar, etc.—can expand attack surfaces, especially when adversaries exploit content that’s hidden or overlooked by typical user defence.
OpenAI said that this issue has been addressed and locked down, and that its new measures are aimed at making future integrations safer by design.
Implications & What Users Should Do
- Users who have connected Gmail, Google Calendar, Google Drive or other services via ChatGPT should check their settings. Disconnecting or disabling automatic or default access for these connectors can reduce risk.
- Be cautious with documents shared by others or calendar invites from unknown senders—especially those containing attachments or links. These could carry hidden, malicious instructions.
- From a policy and tech-design perspective, this incident reiterates the importance of “secure by default” systems, especially in products that operate with personal data. Prompt injection is now a well-known attack vector and needs stronger countermeasures.
