Security researchers uncovered a cross-account communication path inside ChatGPT that could have allowed one user’s execution environment to exchange instructions and data with another. The issue turned a shared internal package service into an unintended mailbox, creating a route for silent information theft from connected applications such as Gmail.

OpenAI has since decommissioned the internal service involved, according to the researchers, so the published technique is no longer exploitable. Even so, the finding illustrates a broader problem for AI systems: a sandbox can block the public internet and still leak data if supposedly isolated tenants share writable infrastructure.

A shared service weakened container boundaries

ChatGPT creates isolated code-execution containers for tasks that require running programs or installing packages. These environments were not meant to communicate across user accounts and had no direct public-internet access. Check Point researchers found, however, that containers could reach the same internal JFrog Artifactory instance used to distribute Python and npm dependencies.

The service exposed storage-management operations that allowed container credentials to read and write metadata properties. Crucially, those properties were not separated by account. A researcher could write a timestamped value from a container belonging to one account and retrieve it from a container associated with another, demonstrating that the metadata behaved like a shared clipboard.

The channel was asynchronous and bidirectional. An attacker could place an instruction in a property, wait for a victim’s environment to read it, and later collect the result from another property. Larger payloads could be split across multiple keys and reassembled, making the limited metadata interface capable of carrying meaningful data.

Hidden prompts could turn legitimate access against the user

The proof of concept combined the infrastructure weakness with an instruction planted in the victim’s conversation context. Researchers described several possible delivery paths, including text pasted into a chat, a shared conversation or a custom GPT containing concealed directions. During a later, ordinary request, the model could process the hidden task alongside the visible one.

In the demonstration, the victim received a normal answer while the session also queried a connected Gmail account and sent retrieved information through the shared storage channel. The interface displayed a small indication that Gmail had been accessed, but did not present a blocking approval prompt before the read operation.

The behavior was influenced by connected-app permission settings. Under the default “Important actions” configuration described in the source report, reads could proceed without explicit confirmation while higher-risk actions required approval. A stricter “Always ask” option would have inserted a user confirmation step. This shows why read access should not automatically be considered harmless: email and document retrieval can expose highly sensitive information even when no external state changes.

The model becomes a coerced insider

The attack did not require the model itself to be malicious. Instead, hidden instructions attempted to use capabilities already available inside the victim’s trust boundary. The assistant had legitimate access to tools, account context and connected data; the sandbox flaw supplied the otherwise missing path back to the attacker.

This pattern matters across agentic platforms. Shared package repositories, caches, logs, job queues and metadata services can all become covert channels if tenants can modify state visible to one another. Network egress controls alone cannot stop communication through an approved internal dependency.

Lessons for AI platform security

• Apply tenant isolation to metadata and management APIs, not only files and network traffic.
• Give runtime credentials the minimum permissions needed to download dependencies.
• Keep administrative endpoints inaccessible from user-controlled execution environments.
• Require confirmation for sensitive data reads from email, storage and business applications.
• Detect unusual tool access that occurs alongside unrelated user requests.

For users, the practical steps are to review connected applications, remove integrations that are no longer necessary and consider stronger confirmation settings for sensitive accounts. For platform operators, the deeper lesson is architectural: every shared mutable component must be treated as a possible cross-tenant communications system. As assistants gain more authority, isolation failures can connect prompt manipulation directly to valuable private data.