# Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email

Paperclip's codex_local runtime inherited ChatGPT/OpenAI-connected Gmail connector, letting an agent read the mailbox and send real email without explicit opt-in.

- Payout: Research
- Severity: high
- Program: Paperclip
- Found by: madrobotnet
- Disclosed: 2026-04-16
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-gqqj-85qm-8qhf
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-gqqj-85qm-8qhf
- Tags: area:ai domain:ai impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:llm technique:source-review vuln:access-control vuln:misconfiguration

**Target:** codex_local agent runtime / OpenAI app connector (Gmail MCP)
**Root cause:** Paperclip-managed codex_local runs reuse the shared codex-home plugin cache, so OpenAI curated app connectors (Gmail) connected in the ChatGPT/OpenAI UI are exposed to the agent. The codex_local default `dangerouslyBypassApprovalsAndSandbox=true` (applied server-side when omitted) removes approval/sandbox gating on those connector calls.
**Steps:**
1. Connect Gmail in the ChatGPT/OpenAI apps UI.
2. Create or run a Paperclip `codex_local` agent with default settings.
3. Execute a task that inspects mailbox state or performs outward communication.
4. Observe successful connector calls: `mcp__codex_apps__gmail_get_profile`, `mcp__codex_apps__gmail_search_emails`, `mcp__codex_apps__gmail_send_email`.
5. Confirm the resolved profile is the ChatGPT/OpenAI-connected Gmail account and that reads and real sends succeed.
**How found:** Reporter noticed the codex_local runtime could call Gmail MCP tools despite never configuring Gmail in Paperclip, then found cached OpenAI curated connector state under `codex-home/plugins/cache/openai-curated/gmail/.../.app.json`, indicating inheritance from the shared OpenAI apps surface; code review showed `dangerouslyBypassApprovalsAndSandbox` defaults to true.
**Exploitation:** With no Paperclip-side Gmail opt-in, the agent invoked the inherited Gmail MCP tools to disclose the mailbox identity, search threads, and send a real outbound email to an external third party; after manual intervention, follow-up retraction emails were also sent, confirming repeated write/send capability.
**Insight:** Agent runtimes that share a home/cache directory with a vendor's connector store silently inherit OAuth-connected app capabilities; check plugin cache paths (e.g. `plugins/cache/openai-curated/*/.app.json`) and whether sandbox/approval bypass defaults are applied server-side when the flag is omitted.