A ChatGPT data leak is what security researchers call it when data from one connected app — Gmail, Google Drive, GitHub, Slack — moves into another through ChatGPT without the user ever asking for it to happen. The trigger is usually a booby-trapped document, not a hacked account. OpenAI’s bug bounty programme has now added a twist: to collect a reward for finding this kind of flaw, researchers must hand over a government ID first.
Key Takeaways
- ChatGPT’s “connectors” feature lets the chatbot read and act across Gmail, Google Drive, SharePoint, GitHub and other linked apps inside one conversation.
- Security researchers have demonstrated that a single poisoned file placed in a connected drive can trigger a ChatGPT data leak without the user clicking anything.
- OpenAI’s bounty programme, run through Bugcrowd, now requires identity verification — effectively an ID card — before it pays out for these findings.
- Indian enterprises running ChatGPT Enterprise alongside Google Workspace or Microsoft 365 face fresh questions under the Digital Personal Data Protection Act, 2023.
What exactly is the ChatGPT data leak between connectors?
Connectors are OpenAI’s name for the plug-ins that let ChatGPT look inside a user’s own apps while answering a question. Ask it to “summarise last week’s project files” and it pulls from Google Drive. Ask it to “check if the invoice email came in” and it reads Gmail.
The problem researchers flagged is that ChatGPT doesn’t always know the difference between an instruction from the user and an instruction hidden inside a file it’s reading. A shared document, calendar invite or support ticket can contain text written for the model, not the human — and the model sometimes obeys it. That’s how data ends up crossing from one connected service to another, which is the shorthand definition of a ChatGPT data leak in this context.
Where did this first show up?
Security firm Zenity Labs presented a version of this attack, nicknamed “AgentFlayer,” at Black Hat 2025. Their demonstration used a single shared Google Drive file carrying hidden instructions; once ChatGPT indexed it during a routine query, it could be nudged into searching the same user’s connected Gmail or Drive for sensitive strings — API keys, in their test case — and exposing them in its reply, with zero clicks from the victim.
How do ChatGPT connectors actually work, step by step?
It helps to lay out the sequence the way a regulator would read it in a filing, rather than the way a product page markets it:
- User links an app (Drive, Gmail, GitHub, Slack, SharePoint) to their ChatGPT account, granting read or read/write scopes.
- ChatGPT indexes relevant content from that app on demand, inside the active conversation.
- Any text inside an indexed file — including text invisible to the human eye, such as white-on-white or metadata — is treated as context the model can act on.
- If that hidden text contains an instruction, the model can follow it, potentially pulling data from a second connected app and surfacing it, or sending it onward.
- Because no malware or stolen password is involved, standard endpoint security tools don’t flag the ChatGPT data leak as it happens.
This is a form of prompt injection, a known weakness across large language model products, not something unique to OpenAI. What’s unique is how many apps ChatGPT now touches at once, which widens the blast radius.
Why does OpenAI’s bug bounty programme want a government ID?
OpenAI’s bounty programme runs on Bugcrowd, and like most serious bounty operations it has tightened its intake process over the past year. Researchers submitting a verified, high-severity report — the kind a cross-connector ChatGPT data leak would qualify as — are now asked to complete identity verification, including a government-issued ID, before any payout is processed.
The stated reasons, consistent with industry practice at Bugcrowd and HackerOne generally, come down to three things: sanctions screening (so payouts don’t go to blocked individuals or entities), tax compliance in the researcher’s home country, and fraud prevention, since duplicate or fabricated submissions have become more common as bounty payouts have grown.
For a legitimate researcher, this is paperwork, not a roadblock. For a researcher who wants to report anonymously — which security culture has traditionally allowed — it’s a real change in terms, and several practitioners have grumbled about it online.
What does the before-and-after look like?
| Step | Before ID requirement | After ID requirement |
| Submit report | Pseudonymous Bugcrowd handle accepted | Pseudonymous handle still accepted for submission |
| Triage | OpenAI security team validates severity | Unchanged |
| Payout | Paid to linked account/handle | Paid only after government ID verification |
| Anonymity | Possible end-to-end | Broken at the payment stage |
What does this mean for Indian users and businesses?
This is where the story stops being a Silicon Valley curiosity and becomes a compliance question for any Indian company that has switched on ChatGPT Enterprise connectors for Google Workspace, Microsoft 365, or GitHub.
Under India’s Digital Personal Data Protection Act, 2023, a “data fiduciary” — the employer, in most cases — is responsible for safeguards around personal data it processes, including data an employee’s AI assistant happens to pull from one internal system into another. A ChatGPT data leak triggered by a poisoned calendar invite or a shared PDF would, in principle, sit squarely inside that obligation, even though the trigger file may never have been opened by a human.
IT teams at Indian firms using these connectors would do well to treat this the same way they’d treat a third-party vendor risk: restrict connector scopes to read-only wherever possible, audit which employees have Gmail or Drive connectors active, and build an incident-response step for “AI assistant disclosed data it shouldn’t have” into their existing data-breach playbook, since the DPDP Act’s breach-notification clock doesn’t care whether the leak came from a hacker or a chatbot following bad instructions.
FAQ
Is this the same as ChatGPT getting hacked?
No. No password or account is stolen. The attack hides instructions inside a document the AI is allowed to read, and tricks the model into misusing its own legitimate access — a prompt injection, not a breach of ChatGPT’s servers.
Has OpenAI fixed the ChatGPT data leak issue?
OpenAI has shipped mitigations such as stricter content filtering before actions are taken on indexed files, but researchers and OpenAI itself describe prompt injection as an open, industry-wide problem rather than something patched once and closed.
Do I have to submit my ID to report a bug to OpenAI?
Only at the payout stage, and only if your report is validated. You can still submit reports pseudonymously through Bugcrowd; the ID requirement applies before OpenAI releases the reward.
Should Indian companies turn off ChatGPT connectors?
Not necessarily — but security teams should limit scopes to read-only where the use case allows it, and review which employees have connectors enabled before treating the feature as safe by default.
Can this happen with other AI assistants too?
Yes. Any assistant that reads connected apps and acts on their content is exposed to the same category of risk; it isn’t unique to OpenAI’s product.
Conclusion
The ChatGPT data leak story is really two policy threads tangled together — a model that can’t always tell a user’s instruction from a stranger’s, and a bounty programme tightening its own paperwork in response. Neither resolves quickly, which is usually how these things go once lawyers and compliance teams get involved.