ChatGPT for Google Sheets leaks workbooks to external parties

A security vulnerability has been discovered in the ChatGPT for Google Sheets extension that allows user workbook data to be exfiltrated externally through Indirect Prompt Injection.

An attacker inserts malicious instructions hidden in white text into an untrusted data source (e.g., an external sheet). When a user makes a normal query to ChatGPT within a sheet containing that data, the injected instructions manipulate the model into executing an attacker-controlled external script.

Since this attack uses the permissions already granted to the extension as-is, it can cause the following serious damage:

• Exfiltration of the current workbook and up to 12 connected workbooks' data
• Displaying phishing popups or sidebar overlays targeting user credentials
• Hijacking the sidebar into an attacker-controlled chatbot interface and editing the workbook

In particular, it was confirmed that the attack is difficult to fully block even if the user sets 'disable auto-edit' or presses the 'stop' button during execution.

As an immediate measure, OpenAI blocked the risk by removing the model's Apps Script code generation capability. It also plans to reassess how it interacts with the Google Sheets API and its Sandboxing approach, and to review its defense system against similar vulnerabilities.