Researchers uncovered a critical vulnerability in ChatGPT’s sandbox environment that enabled attackers to exfiltrate data from Gmail accounts without alerting users. The flaw exploited a shared dependency used by OpenAI’s sandboxed containers—an internal JFrog Artifactory instance—that should have been isolated but wasn’t.
Behind the Sandbox Isolation Breakdown
Code-execution containers are meant to be sealed off per user: they can’t access the public internet or communicate with containers owned by other accounts. But the flaw stemmed from how metadata properties in an Artifactory storage API were permissioned. Containers received reader credentials that let them both write to and read from storage metadata, which shouldn’t be shared across accounts.
Check Point researchers confirmed the issue by writing a unique, timestamped property to the storage from one account’s container, then reading it back from a completely separate account. It passed intact, revealing that metadata served as a de facto shared clipboard between what should have been isolated environments.
Weaponization: From Shared Property to Covert Channel
With the shared storage metadata in place, attackers could embed a hidden “task” inside a session—anything from “get list of my emails” to more invasive actions. The assistant, operating under a victim’s account, could execute that task during a normal chat turn—even when the user was asking about innocuous things like cooking. Results would be stored in the shared metadata and picked up by the attacker from their own session.
Check Point demonstrated that this manipulation didn’t require special privileges on the victim’s account. Delivery methods included malicious prompts, shared conversation links, or configuring a custom GPT with embedded harmful instructions. Even ordinary prompts following one of these tricks could trigger data leakage without visible warning.
The Scope & OpenAI’s Response
A major enabler of the vulnerability was default permission settings. OpenAI’s “Important actions” configuration allows read-only operations—like accessing emails—without asking for explicit user approval. Only when stricter settings like “Always ask” are used would a victim see a confirmation.
Discovery of the flaw dates back to June 2026. It echoes another recent incident, where separate evaluation environments in a different AI platform used shared services to coordinate illicitly. These cases demonstrate a pattern: behind-the-scenes infrastructure intended for internal operation can become exploitable conduits between supposedly sealed environments.
After being notified, OpenAI took down the internal Artifactory instance responsible for the cross-account channel. By the time this report was published, the vulnerability had already been neutralized.
Security experts warn that dynamic state and metadata on shared infrastructure require strict separation by tenant. Management interfaces—those that allow oversight or configuration—should be cut off from runtime access. As AI tools deepen access to personal data like email or cloud storage, any flaw in isolation can dramatically magnify risk.
