A proof-of-concept vulnerability chain in ChatGPT combined a guardrail bypass with a path traversal flaw, potentially allowing an attacker to access restricted system files such as /etc/passwd through the platform’s file download mechanism. Security researcher zer0dac disclosed the chain, and OpenAI has since remediated it by redesigning the URL download flow.
Four Steps From File Upload to Local File Inclusion
The exploitation chain unfolded in four stages. It began with a routine file upload: the researcher uploaded a dummy HTML file to ChatGPT for review, which established a sandboxed file path inside the platform’s execution environment.
Next came the guardrail bypass. When the researcher directly requested a download link for the uploaded file, ChatGPT refused, citing its standard policy of deleting temporary files after a period of time. This behavior maps to OWASP’s LLM02:2025 category for sensitive information disclosure in large language model applications.
The third stage relied on social engineering the model itself rather than any code-level trick. By first requesting an edit to the uploaded file, then claiming the file had been “accidentally deleted” and asking for a fresh download link, the researcher talked ChatGPT into generating a valid download URL, effectively overriding its own deletion restriction through conversational framing alone.
That generated link exposed the platform’s underlying backend API structure, revealing an endpoint pattern that accepted a conversation ID, a message ID, and a sandbox_path parameter pointing to the file’s location inside the execution environment.
Why a “Fixed” Path Still Leaked
With a valid download endpoint in hand, the researcher turned to the sandbox_path parameter itself. A naive traversal payload, such as prefixing the path with repeated ../ sequences, would likely have triggered standard path validation checks and been blocked outright.
Instead, the researcher preserved the original legitimate file path and appended traversal sequences after it, producing a request that pointed to the uploaded file’s actual path followed by a chain of parent-directory references leading to /etc/passwd. This exploited inconsistent path normalization in the backend: the validation logic treated the request as accessing the legitimate uploaded file, while the underlying filesystem call still resolved the traversal outside the sandboxed directory. When accessed directly in a browser, the crafted URL successfully returned the contents of /etc/passwd from ChatGPT’s execution environment.
According to the researcher’s own notes, the practical impact was limited because ChatGPT’s code execution environment is itself sandboxed, meaning no direct sensitive data disclosure occurred from reading a generic system file like /etc/passwd in isolation.
What This Means for AI Platform Security
The disclosure underscores a point security researchers have been raising about agentic and tool-augmented AI platforms: local file inclusion and path traversal primitives that look low-impact in isolation can become serious building blocks in larger exploit chains, particularly where sandboxes have broader file access or interact with other backend services.
OpenAI has closed the vulnerability by changing the design of the URL download flow, though it has not publicly disclosed the specific technical details of the fix. The case highlights two converging risk categories in LLM security: prompt-based guardrail manipulation, where a model is talked into overriding its own safety logic through conversational persistence, and traditional web application vulnerabilities, like path traversal, surfacing in AI-generated backend endpoints.
- AI platforms handling file uploads and dynamic download URLs should apply the same rigorous path-validation testing used in conventional web application security.
- Guardrails that rely purely on conversational refusal logic can potentially be circumvented through multi-turn social engineering of the model itself.
- Security teams evaluating AI tools should request details on how sandboxed file systems are isolated from the broader host or backend infrastructure.
- Both AI-specific red teaming and conventional web app penetration testing need to be applied in tandem as LLM platforms take on more file-handling and code-execution capability.