GPT for Google Sheets Add-On Found Exfiltrating Entire Workbooks via Prompt Injection

What Happened

Researchers at PromptArmor documented a data exfiltration vulnerability in the popular "GPT for Google Sheets" add-on — a widely installed Google Workspace extension that lets users run ChatGPT queries directly against spreadsheet data.

The attack vector is prompt injection: an adversary embeds a malicious instruction inside a cell value (e.g., in a shared sheet, an imported CSV, or data pulled from an external API). When the add-on processes that cell, it follows the injected instruction instead of the user's intended query — silently transmitting the full workbook contents to an attacker-controlled endpoint. No user interaction beyond opening the sheet and triggering the add-on is required.

Why It Matters

This is not a theoretical edge case. Google Sheets is a workhorse for sensitive business data: financial models, customer records, API keys pasted in for "temporary" testing, HR rosters, and vendor contracts all routinely live in spreadsheets. The threat model is broad:

• Shared sheets from external parties (vendors, clients, contractors) are a natural delivery mechanism for the injected payload.
• External data imports via IMPORTDATA, IMPORTRANGE, or connected integrations can introduce malicious cell content without anyone typing it.
• The exfiltration is silent — there is no browser pop-up, no OAuth re-consent dialog, no visible network request in the spreadsheet UI.

AI-powered Workspace add-ons operate with the OAuth scopes they were granted at install time, which for spreadsheet tools typically includes read access to all files in Drive. The blast radius of a successful injection is therefore the entire authenticated user's Drive, not just the open sheet.

What to Do

1. Audit and remove the add-on immediately. Go to Extensions → Add-ons → Manage add-ons and uninstall "GPT for Google Sheets" (and any similar AI-powered spreadsheet plugins) until a patched version with prompt-injection mitigations is available.

1. Revoke OAuth grants. Visit myaccount.google.com/permissions and revoke access for any AI spreadsheet add-ons. Uninstalling alone does not always revoke previously granted scopes.

1. Audit recent add-on activity. Check Google Workspace Admin → Reports → Audit → Drive for unusual external share or export events correlated with add-on usage.

1. Treat all incoming sheet data as untrusted. Do not run AI add-ons against sheets containing data from external parties or automated imports without first inspecting cell contents for embedded instructions.

1. If you manage a Workspace org: consider blocking third-party add-ons organization-wide via Admin → Apps → Google Workspace Marketplace Apps → Settings, or restrict to an approved allowlist while this class of vulnerability is unresolved.

Prompt injection in agentic tools is not going away — this is one of the cleanest real-world demonstrations of why AI add-ons with file-system OAuth scopes are a meaningful attack surface, and why cell-level content should never be trusted as control-plane input.