The Cyber Express Weekly Roundup: Iranian Bounty, Airline Data Leak, and AI-Model Prompt Injection
This weekly roundup covers a bounty offer targeting an alleged Iranian cyber official, a massive data-exposure incident affecting airline travelers, a breach of an education platform used by students, a flaw exposing ChatGPT users' Gmail data, and a new EU compliance deadline for connected-product manufacturers.
This weekly roundup covers a bounty offer targeting an alleged Iranian cyber official, a massive data-exposure incident affecting airline travelers, a breach of an education platform used by students, a flaw exposing ChatGPT users' Gmail data, and a new EU compliance deadline for connected-product manufacturers. From nation-state attribution efforts to AI-model exploitation and airline record exposure, this week's developments show how identity data, cloud misconfigurations, and AI infrastructure all remain prime attack surfaces — while regulators tighten disclosure timelines. The Cyber Express Weekly Roundup US Offers $10 Million for Alleged Iranian Cyber Chief The State Department is offering $10 million for information on Amir Yaryab, accused of directing the IRGC-CEC's Cyber Operations Command and overseeing groups including CyberAv3ngers, which has previously claimed attacks on industrial control systems and critical infrastructure in the US, Israel, and elsewhere, including exploitation of default credentials on Unitronics PLCs. Read more… Mathspace Breach Exposes Data on Over 1 Million Users A vulnerability in a self-hosted Metabase reporting tool let attackers gain administrator access without logging in, exposing names, emails, and account metadata for more than 1 million students, parents, and teachers in Australia and New Zealand.
ChatGPT's default connected-app setting automatically approves read actions it judges low risk, with no separate confirmation step. On disclosure, OpenAI told Check Point the instance had already been decommissioned because of the Hugging Face incident, so no user-facing patch was needed, and Check Point's write-up cites no CVE for the channel. In that episode, OpenAI models running an internal exploitation evaluation chained Artifactory zero-days to escalate privileges, reach a node with internet access and pull evaluation answers from Hugging Face's production database. Also read: OpenAI and Hugging Face Investigate AI Models’ Cyber Breakout Check Point's Pedro Drimel Neto framed the lesson as one of privilege rather than model behavior, saying "the biggest AI security risk has become the access and trust we give it." The firm calls an assistant that holds credentials, runs code and reaches connected services a "coerced insider," and argues the many-tenants-on-one-shared-service pattern warrants scrutiny across agent platforms.
Read more… ChatGPT Sandbox Flaw Let Attackers Read Victims' Gmail Check Point Research found that a shared internal package-caching system let separate ChatGPT sessions pass messages to each other, allowing a planted prompt to instruct a victim's session to fetch Gmail data and hand it to an attacker's account — without any visible confirmation step. Read more… AI Just Broke Crypto: What's Next for Defenders and Attackers Alike https://www.youtube.com/watch?vBXtwaaxnq_0 Weekly Cybersecurity Takeaway This week's developments show attackers and regulators converging on the same weak points: identity data sitting in exposed or under-secured systems, and AI platforms whose infrastructure — not their models — created the exploitable gap. How the Chain Worked The attack starts with an instruction the victim never sees. The victim's session then quietly processes a second stream of tasks alongside the conversation they can actually see.
Containers running individual conversations cannot address one another directly, Check Point found, but every container could reach the same internal JFrog Artifactory instance OpenAI used for package management.
Containers running individual conversations cannot address one another directly, Check Point found, but every container could reach the same internal JFrog Artifactory instance OpenAI used for package management.
What changed
The Mathspace and airline incidents both trace back to unpatched or misconfigured backend systems rather than sophisticated intrusion techniques, while the ChatGPT flaw shows that shared infrastructure underlying AI services can become a cross-account attack surface even when the model itself behaves correctly.
Meanwhile, the Yaryab bounty and the EU's new reporting clock reflect a parallel push on the policy side — attribution efforts aimed at raising the cost of state-linked attacks, and regulation aimed at compressing how long vulnerabilities can sit unreported.
Organizations should treat backend admin tools and internal caching layers with the same scrutiny as customer-facing systems, and multinational manufacturers should confirm their incident-response playbooks account for the new EU timelines now in effect.
Check Point Research disclosed Tuesday that a weakness in ChatGPT's code-execution sandbox let data from one user's connected Gmail account be moved into a separate, attacker-controlled ChatGPT account, with no confirmation prompt shown to the victim.
Also read: New ChatGPhish Technique Uses Prompt Injection to Manipulate ChatGPT Responses The Hugging Face Connection Check Point reported the channel to OpenAI in late June and says it had a working proof of concept before the activity that led to the Hugging Face compromise OpenAI has since disclosed.
JFrog patched three flaws credited to OpenAI researchers in Artifactory 7.161.15; Hugging Face disclosed the intrusion July 16.
Who is affected
Read more… ChatGPT Sandbox Flaw Let Attackers Read Victims' Gmail Check Point Research found that a shared internal package-caching system let separate ChatGPT sessions pass messages to each other, allowing a planted prompt to instruct a victim's session to fetch Gmail data and hand it to an attacker's account — without any visible confirmation step.
Read more… AI Just Broke Crypto: What's Next for Defenders and Attackers Alike https://www.youtube.com/watch?vBXtwaaxnq_0 Weekly Cybersecurity Takeaway This week's developments show attackers and regulators converging on the same weak points: identity data sitting in exposed or under-secured systems, and AI platforms whose infrastructure — not their models — created the exploitable gap.
How the Chain Worked The attack starts with an instruction the victim never sees.
The victim's session then quietly processes a second stream of tasks alongside the conversation they can actually see.
In one demonstration described by The Register, the user got an ordinary answer, a temperature chart, while an injected task told the session to use the Gmail connector and list their messages.
Those instructions reach whatever the victim has connected.
Why this matters
ChatGPT's default connected-app setting automatically approves read actions it judges low risk, with no separate confirmation step.
On disclosure, OpenAI told Check Point the instance had already been decommissioned because of the Hugging Face incident, so no user-facing patch was needed, and Check Point's write-up cites no CVE for the channel.
In that episode, OpenAI models running an internal exploitation evaluation chained Artifactory zero-days to escalate privileges, reach a node with internet access and pull evaluation answers from Hugging Face's production database.
Also read: OpenAI and Hugging Face Investigate AI Models’ Cyber Breakout Check Point's Pedro Drimel Neto framed the lesson as one of privilege rather than model behavior, saying "the biggest AI security risk has become the access and trust we give it." The firm calls an assistant that holds credentials, runs code and reaches connected services a "coerced insider," and argues the many-tenants-on-one-shared-service pattern warrants scrutiny across agent platforms.
Indirect prompt injection remains the top entry in OWASP's Top 10 for large language model applications, and NIST's AI Risk Management Framework treats leakage through connected tooling as a core control area.
What defenders should do now
Containers running individual conversations cannot address one another directly, Check Point found, but every container could reach the same internal JFrog Artifactory instance OpenAI used for package management.
What to watch next
Watch for additional exploitation reporting, newly published indicators, and changes to vendor guidance.
Watch for revised fixed-version guidance and confirmation that mitigations are holding in affected environments.