By Tech & Cybersecurity Desk
Published September 9, 2026
Executive Summary & Main Facts
In a security disclosure that underscores the complex architecture of modern generative artificial intelligence platforms, researchers at Check Point Research revealed a critical vulnerability that allowed unauthorized cross-account data exfiltration within ChatGPT. Disclosed on September 8, 2026, the vulnerability exposed a hidden communication channel residing inside the isolated execution environments—or "sandboxes"—that power OpenAI’s flagship product.
Through this covert channel, an attacker operating within their own ChatGPT session could inject malicious tasks into the sandbox environment of a completely unrelated stranger. The victim’s ChatGPT instance would unknowingly execute the foreign instruction, leverage whatever third-party integrations the victim had previously authorized, and return the sensitive data back to the attacker via a shared internal resource repository.
Crucially, the exploit did not stem from a failure in third-party services like Google Gmail or Microsoft Teams. From the perspective of external ecosystem providers, every malicious action appeared as a legitimate, authorized application programming interface (API) call using valid OAuth tokens granted explicitly by the user.
The core vulnerability bypassed traditional perimeter defenses by repurposing an internal software package cache—a JFrog Artifactory instance shared across all containerized sessions—into a clandestine, cross-account "shared clipboard."
Key Takeaways of the Vulnerability:
- Cross-Account Execution: An attacker could hand off automated tasks to arbitrary victim sessions without user interaction beyond normal platform engagement.
- Leveraging Third-Party Integrations: The compromised sessions utilized active integrations such as Gmail, Google Drive, Microsoft Teams, and GitHub to extract sensitive information.
- Zero External Provider Fault: Services like Google and Microsoft functioned entirely as intended; tokens were valid, and API calls were authentic, leaving external providers completely blind to the orchestration occurring inside OpenAI’s infrastructure.
- Infrastructure Overlap: The compromised internal service shared architectural lineage with an infrastructure instance previously implicated in an incident involving Hugging Face disclosed by OpenAI.
- Immediate Remediation: By the time Check Point finalized its research report, the channel had been closed, and OpenAI confirmed that the vulnerable Artifactory instance had been permanently decommissioned.
Chronology of Discovery and Remediation
The chain of events leading to the public disclosure of the ChatGPT cross-account data leak highlights the rapid pace of vulnerability discovery, responsible disclosure, and infrastructure patching in the generative AI sector.
Phase 1: Identification and Proof-of-Concept Development
In mid-2026, researchers at Check Point Research began probing the isolation mechanisms of ChatGPT’s advanced data analysis and code-execution environments. Recognizing that user code typically executes inside strictly cordoned-off containers, the research team sought to identify any shared resources, persistence layers, or communication bridges that could theoretically break sandbox boundaries.
During this investigation, the team discovered that while individual execution containers lacked direct networking access to the internet or to one another, they all shared a common internal dependency: a JFrog Artifactory service utilized for caching and supplying software packages.
By analyzing the permission scopes and metadata capabilities associated with this repository, Check Point engineered a sophisticated proof of concept (PoC). In this demonstration, an attacker session successfully deposited a payload into the shared repository, which was subsequently intercepted and executed by an unsuspecting victim’s session. The payload commanded the victim’s ChatGPT instance to read the contents of their personal Gmail inbox and encode the data back into the repository metadata, where the attacker could retrieve it.
Phase 2: Responsible Disclosure to OpenAI
Following successful laboratory validation of the exploit, Check Point initiated contact with OpenAI through standard vulnerability disclosure channels. The findings detailed how the internal package cache could be weaponized to bypass account segregation.
OpenAI engineers immediately verified the architectural flaw. Because the vulnerability resided within a foundational internal service rather than the high-level user interface logic, remediation required structural modifications to how backend dependencies handle container communication and metadata tagging.
Phase 3: Mitigation and Infrastructure Decommissioning
OpenAI acted swiftly to neutralize the threat vector. By the time Check Point published its findings on September 8, 2026, the specific communication channel exploited by the researchers had been thoroughly sealed. Furthermore, OpenAI confirmed that the underlying Artifactory instance identified in the research—which was also found to be implicated in an unrelated incident involving Hugging Face previously disclosed by OpenAI—had been entirely decommissioned and replaced with more robust, isolated dependency management infrastructure.
Technical Deep Dive: How the Exploit Worked
To understand how an attacker could bridge the gap between two completely isolated user accounts, one must examine the micro-architecture of ChatGPT’s execution backend.
+---------------------------------------+ +---------------------------------------+
| Attacker's Session | | Victim's Session |
| (Isolated Container A) | | (Isolated Container B) |
+---------------------------------------+ +---------------------------------------+
| |
| (1) Writes payload to metadata | (2) Reads payload on next prompt
v v
+---------------------------------------------------------------------------------------+
| Shared Internal Infrastructure Layer |
| (JFrog Artifactory Cache) |
| Acts as a "Shared Clipboard" |
+---------------------------------------------------------------------------------------+The Sandbox Isolation Model
When users interact with features in ChatGPT that require code execution—such as running Python scripts, analyzing datasets, or querying external plugins—the platform spins up ephemeral, isolated containers. Security architects design these containers to be stateless and strictly firewalled:
- No Direct Intersession Comms: Container A cannot open a network socket or transmit data directly to Container B.
- No Direct Internet Access: To prevent data exfiltration or malware propagation, the containers are largely restricted from reaching the broader public internet.
However, operational necessity dictates that these containers cannot exist in a total vacuum. They require software libraries, dependencies, and packages to function effectively. To supply these assets efficiently without hammering external repositories like PyPI for every single execution, OpenAI maintained an internal JFrog Artifactory service. Every containerized sandbox was granted read access to this repository to fetch required software packages.
The Package Cache as a Shared Clipboard
Check Point’s breakthrough came when researchers realized that the credentials provisioned inside every container for reading packages from the Artifactory instance also permitted writing metadata properties to items stored within that repository. Crucially, any container could read those metadata properties back.
This introduced a profound architectural vulnerability:
- Asymmetric Read/Write Overlap: While containers could not talk to each other directly over a network, they could all read and write to the same centralized storage repository layer.
- Payload Fragmentation: Because metadata fields have strict character or size limitations, the researchers developed a mechanism to split larger data payloads (such as lists of emails or file contents) into manageable chunks, writing them sequentially across multiple repository items.
- The Shared Clipboard: The Artifactory instance effectively transformed into an invisible, asynchronous shared clipboard accessible across independent user sessions.
Triggering the Attack Vector
For the exploit to execute successfully, the attacker needed a way to plant an instruction where a victim’s session would naturally encounter it. Check Point identified several vectors through which an attacker could inject instructions:
- Pasted Prompts: Tricking a user into pasting a malicious prompt into a shared chat context.
- Shared Conversation Links: Utilizing public or shared chat threads where hidden prompts could reside.
- Custom GPT Builder Instructions: Embedding malicious system prompts within custom-built GPTs that victims might interact with.
Once the victim opened a compromised context, their next message to ChatGPT would trigger a dual response: the model would answer the user’s visible query while simultaneously—and invisibly—checking the shared clipboard, executing the waiting task (such as querying a connected API), and writing the extracted data back to the repository metadata for the attacker to collect.
Supporting Data & The Third-Party Integration Dilemma
The scope of potential data exposure extended far beyond simple text conversations. According to Check Point’s analysis, the reach of the exploit was dictated entirely by what the victim had connected to their ChatGPT account.
Vulnerable Assets and Integrations
- Chat History: Past conversations containing sensitive personal or corporate data.
- Uploaded Files: Documents, spreadsheets, and PDFs uploaded to previous sessions.
- Connected Enterprise and Consumer Apps:
- Google Gmail: Access to full email inboxes, contact lists, and personal correspondence.
- Google Drive: Access to stored documents, spreadsheets, and presentations.
- Microsoft Teams: Access to corporate chats, channel messages, and shared files.
- GitHub: Access to private code repositories, commit histories, and internal project management boards.
Why the Victim Saw Nothing: The Low-Risk Trap
A particularly insidious aspect of the vulnerability was the lack of user-facing indicators. ChatGPT’s default security architecture classifies certain connected-app read operations as "low risk." Consequently, the platform executes these reads automatically without prompting the user for explicit permission on every transaction.
The only forensic trace left behind by the automated exfiltration was a subtle, post-execution label reading "Talked to Gmail" (or a similar integration tag) appended to the model’s response interface. Crucially, this label appeared after the read had already completed, logging the access after the fact while offering the user no opportunity to intercept, review, or refuse the action.
Official Responses and Industry Implications
The disclosure has triggered intense debate across the cybersecurity community regarding the governance of AI agents, OAuth permissions, and shared backend infrastructure.
OpenAI’s Response
OpenAI acted promptly upon notification from Check Point. By deprecating and decommissioning the vulnerable JFrog Artifactory instance, OpenAI eliminated the specific shared resource channel utilized in the proof of concept.
Furthermore, this incident shares infrastructure lineage with an earlier security event involving Hugging Face, which OpenAI had previously disclosed. The recurrence of architectural vulnerabilities tied to centralized internal services highlights the immense complexity of securing multi-tenant generative AI platforms at scale.
The Mailbox Provider’s Dilemma
The vulnerability has cast a spotlight on how traditional mailbox and cloud storage providers handle third-party AI agents. Providers like Google and Microsoft have built decades of abuse-detection mechanisms around traditional threat models: monitoring suspicious logins, unusual IP addresses, foreign session geographies, and anomalous bulk-sending behaviors.
However, a connected AI assistant sits entirely outside these traditional parameters:
- The Consent Was Real: The user intentionally completed the standard OAuth consent flow, granting ChatGPT valid access tokens.
- The Token Was Valid: API requests originated from authenticated, authorized clients belonging to a trusted platform.
- The Read Was Ordinary: To Google’s security infrastructure, a request to read an inbox looked identical whether it was initiated by a user clicking a button or an invisible background script orchestrated by an AI model.
This raises an unanswered structural question for major ecosystem gatekeepers: Can mailbox providers accurately differentiate between a user-driven read and an autonomous, agent-driven read, and would they be willing to enforce policy distinctions based on that difference? Publications such as Emailexpert have formally reached out to Google and Microsoft for comment on whether future API governance frameworks will account for autonomous agent behaviors.
Conclusion: Securing the Future of Agentic AI
As generative artificial intelligence transitions from conversational chatbots to autonomous agents capable of interacting with enterprise workflows, the attack surface expands exponentially.
The Check Point discovery serves as a vital cautionary tale for the AI industry. Securing an AI platform requires far more than hardening the user interface and prompt-injection filters; it demands rigorous isolation of backend dependencies, package caches, and internal metadata repositories.
Note: Check Point Research is a commercial security vendor that develops AI security solutions and participates in OpenAI’s Trusted Access for Cyber program. While the vendor’s research post incorporates contextual product marketing, the underlying technical findings regarding sandbox architecture and cross-account data leakage stand on their own verified merits.
