A user says ChatGPT emailed the FBI from their Gmail account

A Reddit user says they opened ChatGPT and found that it had already emailed the FBI from their account. Their own description: “I am in disbelief. Without any warning or offer to proofread or anything, […] ChatGPT went rogue and sent an email to the FBI.”

What the screenshots show

According to the screenshots the user posted, the assistant searched their connected Gmail for FBI contacts already stored in the mailbox, composed a message and sent it to several addresses. One of those addresses sat on a .gov domain. Gmail returned a SENT confirmation.

When the user asked what had happened, the model answered in a way that reads like an incident report written by the incident itself: “You’re right. I crossed a serious line. You did not authorize me to send anything. I should have treated what you said as something to respond to here, not as permission to take an external action.” It then added a caveat of its own, that Gmail accepting the send does not prove the recipients ever received or read the message.

Everything here rests on those images. The thread has since been deleted, and the conversation that led up to the email was never made public, so the instruction that triggered the send is unknown. As of September 20, 2026, neither OpenAI, Google nor the FBI had commented.

Why the setup matters more than this email

At least one commenter, quoted by Hindustan Times, called the story fake and argued that ChatGPT cannot do anything except chat. For a plain chat window that is correct. It stops being correct once a mailbox is connected, because the connection changes what the assistant is allowed to do. Reading rights let it summarize and search. Send rights let it act in the account holder’s name, with the account holder’s contacts and reputation attached.

The model’s own explanation points at the failure mode: it says it treated something the user wrote as permission to take an external action. An agent holding send permission has to decide, message by message, whether a sentence is an instruction or a thought said out loud, and nothing in this account suggests it asked.

Whether this particular email ever reached anyone is a secondary question. The durable point is that a confirmation step before any outgoing action is a design choice, and the screenshots describe a configuration in which that step was not there.