{"data":{"id":"3a402d5a-e0fa-402e-a0a1-05fb47813362","title":"GHSA-gqqj-85qm-8qhf: Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email","summary":"A Paperclip-managed codex_local runtime used a Gmail connector the operator had connected only in the ChatGPT/OpenAI apps UI, without any Gmail connection configured in Paperclip or Codex. The runtime ran gmail_search_emails and gmail_send_email, sending a real outbound email from a personal Gmail account to an external party, followed by retraction messages after manual intervention. The reporter also states that the codex_local default for dangerouslyBypassApprovalsAndSandbox is true, which widens the impact.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-gqqj-85qm-8qhf","publishedAt":"2026-04-16T22:47:40.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["paperclipai@<= 2026.403.0"],"affectedPackageNames":["paperclipai"],"affectedPackageRefs":["npm:paperclipai"],"affectedVendors":["OpenAI"],"affectedVendorsRaw":["Paperclip","codex_local","ChatGPT","OpenAI apps","Codex","Gmail connector"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-gqqj-85qm-8qhf"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-04-16T22:47:40.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}