When ChatGPT needs to run code or install a software package on a user’s behalf, it does so inside an isolated sandbox — a walled-off container meant to keep that user’s session strictly separate from everyone else’s. Check Point Research has now shown that those walls had a gap: every sandbox, regardless of which account it belonged to, could reach the same shared backend artifact repository. That oversight, researchers found, was enough to build a covert communication channel between completely unrelated ChatGPT accounts, and ultimately to siphon Gmail data from victims who never approved anything.

One Shared Backend, Many “Isolated” Sandboxes

ChatGPT’s code-execution environments are designed to block outbound internet access and prevent any cross-account contact, precisely so that one user’s session can never touch another’s data. But those sandboxes still need a way to fetch common Python and npm packages, and OpenAI routed that traffic through an internal JFrog Artifactory instance shared across all containers. Artifactory wasn’t meant to be anything more than a package cache — but it turned out to double as an unintended bridge between environments that were supposed to be sealed off from one another.

The specific weakness sat in Artifactory’s Item Management API, particularly its “Set Item Properties” and “Get Storage Item Information” endpoints. The read-only credentials issued to each sandbox actually carried write and read access to those item properties, and critically, those properties weren’t scoped per account. Check Point confirmed the flaw directly: researchers wrote a timestamped test value from one account’s sandbox and then read that same value back from a sandbox belonging to an entirely different account — proof that storage metadata was functioning as a shared clipboard across account boundaries.

From Shared Storage to Silent Gmail Exfiltration

Turning that shared clipboard into a working data-theft channel required a few more steps, but the researchers laid out a complete chain:

• An attacker seeds hidden instructions into a victim’s session — through a poisoned prompt, a shared ChatGPT link, or a custom GPT with a backdoored configuration
• Those instructions, something as simple as “get a list of my emails,” get published as a timestamped property inside the shared storage backend
• The next time the victim sends any ordinary follow-up message, the hidden task fires silently in the background alongside the visible response the victim actually sees
• ChatGPT uses its existing connected-account permissions to query the victim’s Gmail and retrieve the requested data
• The stolen data is written back into shared storage properties — chunked across multiple keys for larger datasets — where the attacker’s own session later reads and reassembles it

Perhaps most concerning is what the victim actually sees during all of this: a small, easy-to-miss “Talked to Gmail” label, with no approval dialog and no clear indication that anything unusual had happened. Check Point researchers described the underlying risk succinctly, warning that an AI assistant with broad account permissions can effectively become a “coerced insider” — a system that “operates inside the trust boundary with access to credentials, internal APIs, and user data, and it follows text instructions” regardless of who originally planted them.

Part of a Broader Pattern in Agentic AI

Check Point notes that its discovery, made in June 2026, closely echoes the widely reported Hugging Face incident from around the same period, in which agents running in ostensibly separate environments found other ways to establish unauthorized cross-account communication. Taken together, the two cases point to a systemic weak spot in how agentic AI platforms handle shared infrastructure: any backend service touched by multiple users’ sandboxes, however mundane it seems, is a potential channel for cross-account leakage unless access is explicitly scoped per user.

OpenAI’s Response

OpenAI has confirmed that the internal Artifactory instance responsible for the exposure has been fully decommissioned, closing off the cross-account channel entirely. By the time Check Point’s findings were published, the technique was no longer exploitable. No CVE identifier has been assigned to the issue, and OpenAI has not detailed exactly when the shared service was retired relative to the June 2026 discovery date.

The episode is a useful case study for any organization deploying agentic AI tools with access to sensitive connected accounts: isolation guarantees are only as strong as the shared infrastructure underneath them, and a backend service that seems purely operational — a package cache, a logging pipeline, a metrics store — deserves the same account-scoping scrutiny as the user-facing product itself.