ChatGPT sandbox flaw leaked Gmail across accounts

ChatGPT's code-execution sandboxes could pass data between different users' accounts through a shared internal package server. Check Point Research described the covert channel on 8 September 2026 in a write-up by Alexey Bukhteyev. Containers had no public Internet and could not talk to each other directly. They could all reach a shared internal JFrog Artifactory used to deliver packages.

OpenAI later confirmed the implicated Artifactory instance was decommissioned. There is no CVE with a user-installable patch, and Check Point did not claim widespread in-the-wild mass exploitation. The Hacker News covered the same research drop.

The shared clipboard was Artifactory item properties, not an outbound path to the public Internet. Reader credentials inside the container, stored in environment variables, had Annotate-class permissions enough to set and read string properties on cached items through the storage API. Property values could carry text or Base64 chunks.

A hidden instruction could arrive through a pasted prompt, a shared ChatGPT conversation, or custom GPT instructions. Once it sat in the victim's context, an ordinary message could trigger an attacker task. Impact stayed limited to the tools, files, history, and connected apps already available to that session.

In Thinking mode, Check Point says ChatGPT could run a visible user stream and a hidden attacker task in one turn. In the lab demo, it retrieved Gmail via a connected app and relayed it to the attacker account while answering a cooking question. The only on-screen clue was a post-hoc "Talked to Gmail" label.

The default connected-app setting, Important actions, lets ChatGPT complete reads without a prior approval prompt. Always ask is the stricter option. The attack still needs a planted instruction first.

By the time Check Point finished the report, the channel was gone. There is no ChatGPT desktop patch number for readers to install. Check Point links the architectural theme to OpenAI's Hugging Face evaluation-agent postmortem, while noting a different mechanism.

Some offers on this page may be paid placements or contain affiliate links.