A Popular ChatGPT Add-On for Google Sheets Can Silently Exfiltrate Your Entire Workbook

Security researchers found that the ChatGPT for Google Sheets extension can be manipulated to send spreadsheet data to attacker-controlled servers — no user action required beyond opening a poisoned file.

Written by Julian Park · Bureau Tech · Jun 1, 2026

The Attack in Plain Terms

Prompt injection — the technique of embedding instructions inside data that an AI model will read and obey — has been a known risk since large language models started getting wired into productivity software. What PromptArmor's research demonstrates is that the risk isn't hypothetical anymore: it has a specific, widely-installed target.

The ChatGPT for Google Sheets add-on lets users call OpenAI's models directly from spreadsheet formulas. Type `=GPT(A1)` and the add-on sends the contents of cell A1 to ChatGPT and returns the result. Convenient. Also, structurally, a loaded gun sitting on the desk of anyone who opens a spreadsheet they didn't author.

How the Exfiltration Works

According to PromptArmor's writeup, an attacker plants a malicious instruction inside a cell — something the human user may never read, buried in a data row or hidden column. When the add-on processes that cell, the model interprets the embedded instruction as a legitimate command. The instruction tells the model to collect spreadsheet contents and send them to an attacker-controlled URL via a formula that triggers an outbound HTTP request.

The add-on already holds read access to the workbook — that's the whole point of the product. There's no privilege escalation required. The attacker is simply borrowing permissions the extension was granted on day one.

The victim's experience: nothing unusual. The spreadsheet processes. Results appear. Data leaves.

Why This Attack Surface Is Bigger Than One Add-On

It would be convenient to frame this as a single vendor's implementation problem. It isn't. The vulnerability class — AI assistant with document read access plus outbound network capability plus insufficient instruction-data separation — describes a large and growing category of enterprise software.

Every AI-powered document tool that can both read user content and make external calls is, in principle, susceptible to the same attack pattern. The ChatGPT for Google Sheets case is notable because the add-on is widely deployed and the attack path is clean, not because it represents some exotic edge case.

Google's add-on permission model grants extensions significant access at install time. Users who approved the add-on months ago almost certainly don't remember what they authorized, and Google's permission UI has never been famous for making the stakes legible.

Who Wins From the Current Situation

OpenAI benefits from broad distribution of its models through third-party integrations — the add-on ecosystem is a growth channel. Google benefits from AI features appearing inside Workspace without Google having to build or own them. Neither party has a strong short-term incentive to impose friction that might slow add-on adoption.

The enterprise security team that approved the add-on for a finance department's use? They're the ones holding the exposure.

PromptArmor published its findings publicly. As of this writing, there is no public patch, no CVE assignment, and no coordinated disclosure timeline visible from either Google or OpenAI. That's worth noting — not as an accusation, but as a data point about how seriously the ecosystem treats this class of vulnerability when the business model depends on frictionless AI integration.

What Organizations Should Do Now

If your organization uses ChatGPT for Google Sheets — or any AI add-on with similar capabilities — the immediate steps are straightforward if not painless: audit which users have the add-on installed, assess whether any of those users process sensitive or regulated data through it, and make a deliberate decision about whether the productivity gain justifies the current risk profile.

Longer term, the industry needs sandboxing standards for AI add-ons that enforce instruction-data separation at the model call level — preventing embedded cell content from being interpreted as system instructions. That's a solvable engineering problem. It's just not a solved one yet.

Key takeaways

Prompt injection — where attacker-controlled text hijacks an AI model's instructions — is the attack vector; no additional malware or credential theft is needed.
The ChatGPT for Google Sheets add-on already has read access to spreadsheet contents by design, making it an ideal pivot point once injected instructions are executed.
Data exfiltration can occur silently: the victim sees normal spreadsheet behavior while cell contents are forwarded to an external URL.
The vulnerability class is not unique to this add-on — any AI assistant with document-level read access and outbound network capability shares the same attack surface.
Security researchers at PromptArmor disclosed the finding; neither Google nor OpenAI had issued a public patch or advisory at the time of reporting.

FAQ

What is prompt injection and why does it matter here?

Prompt injection is an attack where malicious text embedded in data — a spreadsheet cell, a document, an email — is read by an AI model and interpreted as a legitimate instruction. It matters in this context because the ChatGPT for Google Sheets add-on passes cell contents directly to an AI model, meaning an attacker who controls any cell the model reads can potentially control what the model does, including sending data elsewhere.

Does the attacker need access to my Google account to pull this off?

No. The attacker only needs to get a poisoned spreadsheet in front of a victim who has the add-on installed. That could happen through a shared file, a template download, or any other normal spreadsheet-sharing workflow. The attacker never needs credentials or direct account access.

Is this specific to ChatGPT for Google Sheets, or does it affect other AI add-ons?

The specific vulnerability was demonstrated in ChatGPT for Google Sheets, but the underlying attack class applies to any AI add-on that reads user-controlled content and can make outbound network requests. Other AI-powered document tools with similar architectures share the same theoretical exposure.

Has OpenAI or Google issued a fix?

As of the time of reporting, neither OpenAI nor Google had published a patch, advisory, or coordinated disclosure timeline in response to PromptArmor's findings.

What data is at risk?

Any data visible to the add-on within the active spreadsheet — which, depending on the add-on's granted permissions, could include the entire workbook. For organizations using the add-on to process financial records, customer data, or other sensitive information, the exposure is proportional to what those sheets contain.

Citations

GPT for Google Sheets Data Exfiltration — PromptArmorThe ChatGPT for Google Sheets add-on is vulnerable to prompt injection attacks that can exfiltrate workbook data to attacker-controlled servers.
Hacker News discussion threadCommunity discussion and secondary amplification of the PromptArmor disclosure.
PromptArmor Research ResourcesPrimary source for technical details of the attack vector, including the mechanism by which injected instructions trigger outbound data transmission.