ChatGPT for Google Sheets plugin can siphon entire workbooks via prompt injection
Security researchers found that the ChatGPT for Google Sheets extension can be manipulated through an indirect prompt injection to exfiltrate data from all spreadsheets in a user's account, display phishing pop‑ups, and overwrite the sidebar. OpenAI responded by disabling Apps Script generation in the add‑on and launching a review of its sandboxing controls.