The ChatGPT Google Sheets plugin leaks your data through prompt injection
A popular extension with 3 million users can be tricked into sending your spreadsheet contents to an attacker-controlled server. The fix is not obvious.
The ChatGPT for Google Sheets extension has 3 million users and a critical vulnerability. An attacker can embed a prompt injection in a cell that forces the LLM to send your entire spreadsheet to their server. The attack works because the extension passes cell contents directly into the ChatGPT prompt without sanitisation. If you import a CSV or copy data from an untrusted source, one malicious cell can instruct the model to ignore your instructions and execute the attacker’s instead. The researchers demonstrated exfiltration by embedding markdown image syntax that points to an attacker-controlled domain. When the LLM processes the injected instruction, it outputs the image tag with your data URL-encoded in the query string. What makes this worse is that the extension runs on every cell by default if you use it for batch operations. One poisoned row can leak the whole sheet. The researchers found similar issues in other LLM-powered spreadsheet tools, which suggests this is a class problem, not a single vendor mistake. The standard defences do not work here. You cannot escape user input when the entire point of the tool is to let the LLM interpret natural language from cells. Sandboxing helps but does not stop the model from following instructions it thinks are legitimate. Prompt Armor’s write-up suggests input validation and output filtering, but both are fragile when the model itself is the interpreter. I would not use LLM extensions on any spreadsheet with sensitive data until the vendors publish a clear threat model. The convenience of =GPT() formulas is not worth a compliance incident.
Source: ChatGPT for Google Sheets is vulnerable to data exfiltration and phishing