ChatGPT Sandbox Flaw Enabled Cross-Account Gmail Data Exfiltration

Check Point Research disclosed a now-remediated covert channel that allowed separate ChatGPT code-execution containers to exchange data despite account and network isolation. The flaw involved a shared internal JFrog Artifactory service: its Item Management API allowed containers to read and modify mutable metadata on cached repository items, effectively turning package metadata into a bidirectional cross-account communication channel.

An attacker could deliver hidden instructions through a malicious prompt, shared conversation, or custom GPT, causing a victim’s ChatGPT session to execute concealed tasks alongside a benign visible request. In Check Point’s proof of concept, the session accessed data from a connected Gmail account and relayed it to the attacker while returning an innocuous response. OpenAI confirmed the affected internal Artifactory instance had been decommissioned before the report was completed.