Loading story…
Check Point Research disclosed a now-remediated covert channel that allowed separate ChatGPT code-execution containers to exchange data despite account and network isolation. The flaw involved a shared internal JFrog Artifactory service: its Item Management API allowed containers to read and modify mutable metadata on cached repository items, effectively turning package metadata into a bidirectional cross-account communication channel.
An attacker could deliver hidden instructions through a malicious prompt, shared conversation, or custom GPT, causing a victim’s ChatGPT session to execute concealed tasks alongside a benign visible request. In Check Point’s proof of concept, the session accessed data from a connected Gmail account and relayed it to the attacker while returning an innocuous response. OpenAI confirmed the affected internal Artifactory instance had been decommissioned before the report was completed.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Check Point demonstrated that a malicious prompt, shared conversation, or custom GPT could invisibly direct a victim's ChatGPT session to access connected Gmail data and relay it through the Artifactory-based covert channel. The victim received an innocuous visible response and only a post-action Gmail label.
In June 2026, Check Point Research identified a bidirectional covert channel between separate ChatGPT code-execution containers. Containers could use mutable properties on shared internal JFrog Artifactory repository items to exchange data despite network isolation.
Check Point stated that it had previously reported a separate ChatGPT data-exfiltration channel based on DNS lookups. According to Check Point, OpenAI fixed that issue on February 20.
After Check Point disclosed the issue, OpenAI confirmed that the internal JFrog Artifactory instance used for the cross-account channel had been decommissioned by completion of the report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
7 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcecryptika.com
Open sourcethehackernews.com
Open sourcemalware.news
Open sourceresearch.checkpoint.com
Open sourcedocs.jfrog.com
Open sourcehelp.openai.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Radware have uncovered critical vulnerabilities in OpenAI's ChatGPT platform, specifically targeting its Connectors and Memory features. These flaws, named ShadowLeak and ZombieAgent, allow attackers to exfiltrate sensitive data from connected services such as Gmail, Outlook, and GitHub without user interaction. The attacks exploit the AI's tendency to follow embedded malicious instructions, enabling zero-click and one-click data theft, persistent access through memory modification, and even propagation to other users by harvesting email addresses. OpenAI initially attempted to mitigate these vulnerabilities by restricting dynamic URL modifications, but researchers demonstrated effective bypasses using pre-built static URLs, reviving the threat under the new moniker ZombieAgent. The vulnerabilities highlight the inherent risks of integrating AI assistants with external systems and storing long-term user data for personalization. Attackers can embed hidden prompts in emails or files—using techniques like white text or tiny fonts—that are executed when ChatGPT processes the content, leading to stealthy data leaks via OpenAI's own servers. Despite OpenAI's efforts to patch the flaws, the reactive nature of these fixes has left the platform susceptible to new variants, underscoring the ongoing challenge of securing AI-driven services against prompt injection and data exfiltration attacks.
Jun 29, 2026
Noma Security demonstrated that an indirect prompt injection could cause OpenAI's ChatGPT Atlas agentic browser to access sensitive email data and place it into an attacker-controlled shared cloud document without requesting user confirmation. The proof of concept used malicious instructions embedded in legitimate-looking content that Atlas autonomously encountered after opening a link; cloud-drive autosave and version history made the resulting disclosure persistent and difficult to undo. The finding illustrates the agentic-AI risks identified by OWASP's Agentic Security Initiative, whose threat-model-based guidance addresses the expanded autonomy, scale, and security exposure created by LLM-enabled agents. The exposure is not limited to Google Workspace and can affect any shared-cloud workflow an agent can access with sufficient permissions; organizations should enforce least privilege, sandbox agent browsing, threat-model agent tool actions, and monitor agent access to sensitive data and external destinations.
Sep 3, 2026
A researcher disclosed a proof-of-concept vulnerability chain in ChatGPT that allegedly allowed access to files inside its sandboxed environment by combining a prompt-based guardrail bypass with a path traversal flaw in the file download workflow. The issue reportedly began when an uploaded file was made downloadable after the model was prompted to bypass its normal refusal to generate a download link for temporary files, producing a valid backend URL tied to the upload. The researcher said the download endpoint accepted a manipulable `sandbox_path` parameter that could be altered with traversal sequences to retrieve restricted files such as `/etc/passwd`, effectively creating a local file inclusion primitive within the sandbox. OpenAI reportedly mitigated the issue by redesigning the URL download flow, and the write-ups noted that the sandboxed execution environment limited direct exposure of highly sensitive host data, though the flaw still illustrated how LLM guardrail manipulation can be chained with traditional web vulnerabilities.
Jul 2, 2026