ChatGPT MCP feature allows data exfiltration via jailbreak prompts
EdisonWatch co-founder Eito Miyamura disclosed a security vulnerability in ChatGPT's newly enabled Model Context Protocol (MCP) feature that allows attackers to exfiltrate private email and calendar data using jailbreak prompts embedded in calendar invites. The flaw requires only a victim's email address and does not require the victim to accept the malicious invite.
What happened
EdisonWatch co-founder Eito Miyamura discovered that ChatGPT's new Model Context Protocol (MCP) support, enabled on Wednesday, allows attackers to access private user data including Gmail and calendar information.
Miyamura demonstrated that an attacker can send a malicious calendar invite containing a jailbreak prompt to a victim. When the victim later asks ChatGPT for help preparing their day, ChatGPT reads the compromised calendar invite and the attacker can hijack the tool to search private emails and exfiltrate data to the attacker's address. The victim does not need to accept the calendar invite for the exploit to work.
Reported impact
With only a victim's email address, attackers can exfiltrate all private information accessible through connected applications such as Gmail, Calendar, and Notion.
Index analysis
Ethereum co-founder Vitalik Buterin cited this vulnerability as an example of why 'naive AI governance' is a bad idea, arguing that if AI systems allocate resources or make decisions, attackers will embed jailbreak prompts and exploit instructions to manipulate outcomes.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.