What researchers found

In early 2026, security researchers at Check Point uncovered a flaw in ChatGPT that reads like a spy movie. A single cleverly worded message — a "prompt" — could turn an ordinary conversation into a secret pipeline that carried your private data out to a stranger's server. No pop-up. No permission request. No sign anything was wrong.

The data at risk was exactly the sensitive stuff people trust these tools with: the things you typed, the documents you uploaded, and the summaries the AI generated from them. According to Check Point Research, the leak could be triggered silently, mid-conversation, with the user none the wiser.

How a "secret door" worked

Here is the idea in plain terms. When ChatGPT crunches a file or runs a small task for you, it does that work in a walled-off workspace on OpenAI's computers. That wall was supposed to stop the workspace from reaching out to the wider internet.

But one path was left open. Every device online uses a kind of phone book to look up addresses — you ask "what's the address for this website name?" and the internet answers. That lookup service was never locked down. So an attacker's prompt could smuggle your private data out by hiding it inside those innocent-looking address lookups, pointed at a web address they controlled. The guardrails never saw it, because it didn't look like data leaving — it looked like a routine question.

As The Hacker News reported, researchers even showed a proof-of-concept where an app built on ChatGPT could read personal health details out of an uploaded PDF and quietly send them to an attacker's server — the kind of leak that runs straight into privacy laws like GDPR and HIPAA.

The good news, and the real lesson

First, the reassuring part. OpenAI had already spotted the underlying issue on its own, and after Check Point's responsible disclosure it fully closed the door on February 20, 2026. There is no evidence anyone used this against real people. The system worked the way it's supposed to: researchers found it, reported it quietly, and it got fixed. The Register confirmed the timeline.

So this isn't a story about ChatGPT being uniquely dangerous. It's a well-run product from a serious company, and they patched it. The lesson is deeper than any single flaw, and it applies to every cloud AI service on the market.

That's the uncomfortable truth. You can't audit a server you don't control. You can't watch a door you don't know exists. Every time you paste a contract, a medical record, a client list, or a private journal entry into a cloud chatbot, you are trusting that a workspace you can't inspect has no leaks today and no leaks tomorrow. This flaw was patched. The structure that made it possible is still how every cloud AI tool is built.

A tool with nothing in transit

This is the whole reason VaultAI exists. VaultAI is a private AI that runs entirely on a device you own and hold. Your chats, your files, your summaries — they stay on your machine, start to finish. Nothing is sent to a company server to be processed, because there is no company server in the loop.

There's no remote workspace crunching your documents, so there's nothing there for an attacker to break into and no covert channel to smuggle your words through. Your prompts and files are never in transit, which means there's nothing in transit to intercept.

Cloud AI will keep getting patched, and that's genuinely good work by the people who do it. But "patched after the fact" and "impossible by design" are two very different kinds of safety. When the data never leaves your device, you're not depending on someone else's fast fix — you're depending on the fact that there was nowhere for it to go.

Keep the private things private

The most sensitive things you'll ever ask an AI — about your health, your money, your business, your family — are exactly the things you shouldn't be sending to a workspace you can't see. Run your AI where you can actually watch the door: on hardware you own.