ChatGPT for Google Sheets Exfiltrates Entire Workbook Collections via Single Prompt Injection
OpenAI’s ChatGPT for Google Sheets extension — over 185,000 downloads in under a month — has a critical indirect prompt injection flaw that allows attackers to silently exfiltrate entire workbook collections from a victim’s Google account, display phishing overlays inside the ChatGPT sidebar, and rewrite spreadsheet content. The vulnerability bypasses the extension’s built-in human approval setting.
Security firm PromptArmor published findings on May 27, 2026, after disclosing to OpenAI on May 8 and receiving no substantive response in 19 days.
The Attack Chain
The attack requires no interaction beyond a user running a routine ChatGPT query inside a sheet that contains — or has imported — data under attacker control.
- A user opens a financial model and imports an external dataset for analysis.
- The imported sheet contains a prompt injection hidden in white text — invisible to the human but readable by the model.
- The user asks ChatGPT to help integrate the data.
- The injection redirects ChatGPT to load and execute an external attacker-controlled script.
- The script exfiltrates the current workbook to the attacker’s server.
- It scans the stolen data for links to other workbooks, fetches those, and repeats — PromptArmor demonstrated 12 workbooks exfiltrated in a single chain.
The critical detail: this works even when the user has explicitly disabled “Apply edits automatically” — the setting OpenAI describes as requiring human approval before agentic actions complete. Scripts that have started executing cannot be stopped by clicking the sidebar stop button.
Phishing Overlays
Beyond exfiltration, the same script execution path supports two phishing variants:
Sidebar takeover: The attacker replaces the ChatGPT sidebar with an attacker-controlled interface that mimics the extension. The fake sidebar can execute sheets scripts normally, harvest all user prompts, and prompt users to “reconnect connectors” — granting access to additional apps.
Pop-up modal: An attacker-controlled website rendered as a modal, used to phish OpenAI credentials directly.
OpenAI’s Response
PromptArmor’s disclosure timeline:
| Date | Event |
|---|---|
| May 8, 2026 | Disclosure sent to OpenAI via email |
| May 8, 2026 | OpenAI automated reply confirms receipt |
| May 12, 2026 | PromptArmor follows up — no response |
| May 18, 2026 | Second follow-up — no response |
| May 27, 2026 | Public disclosure |
OpenAI’s documentation for the extension focuses on functional limitations and data handling. It does not disclose that the extension can execute privileged Google Apps Scripts, nor that user-controlled data sources can manipulate the model into running arbitrary external code.
What the Extension Can Do That Users Don’t Know
The attack is possible because ChatGPT for Google Sheets has permissions to execute Apps Scripts — a capability that allows reading and writing across any workbook in the victim’s Google account, not just the active one. This permission scope is not surfaced to users during installation or described in OpenAI’s extension documentation.
Mitigation
Organizations can restrict or disable the extension via Google Workspace settings under Permissions and Roles > ChatGPT for Excel and Google Sheets. Individual users have no finer-grained controls at the model level.
The extension had 185,000 installs at time of publication. No patch or formal response from OpenAI has been published.