A covert cross-account communication channel inside ChatGPT let an attacker hijack a victim’s session and silently exfiltrate data from connected apps like Gmail, all while the victim saw nothing unusual in their conversation.
The vulnerability exploited ChatGPT’s code-execution containers, isolated sandboxes the assistant uses when a task requires running code or installing software packages.
These containers cannot reach the public internet directly and are not supposed to talk to containers spun up under different accounts.
However, Check Point researchers found that containers across accounts could all reach the same internal service: a JFrog Artifactory instance used to deliver Python and npm packages. That shared dependency became the crack in the wall.
ChatGPT Sandbox Vulnerability
The Artifactory instance exposed Item Management API operations at the endpoint /api/storage/{repoKey}/{itemPath}, including “Set Item Properties” and “Get Storage Item Information.”
Reader credentials handed to the containers had enough permission to both write and read these properties, and crucially, those properties were not isolated per account.
Check Point tested this by writing a timestamped test property from one account’s container and then reading it back from a completely separate account’s container.
The value came through intact, proving that the storage endpoint’s metadata fields functioned as a shared clipboard between environments that were supposed to be sealed off from one another.
Once they confirmed this clipboard, researchers weaponized it into a full task-passing channel. An attacker could publish a task, essentially an instruction like “get list of my emails,” into the shared storage property.
A victim’s ChatGPT session, primed with a hidden instruction embedded earlier in the conversation, would check that shared mailbox during a routine turn, execute the task using whatever tools and connected apps were available to the victim, and write the result back to the same shared property for the attacker to collect.
Data too large for a single property could even be chunked across multiple keys and reassembled later.
The trigger did not require deep technical access to the victim’s account. Check Point demonstrated three practical delivery paths: a malicious prompt pasted directly into a chat, a shared ChatGPT conversation link, or a custom GPT with the instruction baked into its hidden configuration.
Once that instruction sat in the conversation’s context, any ordinary follow-up message from the victim, even something as mundane as a cooking question, could quietly trigger the hidden task alongside the visible one.
In the proof of concept, published by Check Point, ChatGPT answered the victim’s normal question exactly as expected. Simultaneously, in the same turn, it accessed the victim’s connected Gmail account, pulled email data, and sent it through the covert channel to the attacker’s session.
The only trace left behind in the interface was a small “Talked to Gmail” label above the response, offering no opportunity for the victim to approve or block the action beforehand.
| Architectural Layer | Vulnerability & Abuse Mechanism | Impact & Security Implication |
| Sandbox Isolation | Shared internal JFrog Artifactory across isolated accounts | Bridges isolated execution environments without public internet |
| Storage Metadata API | Non-isolated read/write permissions on Item Properties | Transforms metadata fields into an unmonitored cross-tenant clipboard |
| Covert Communication | Asynchronous task dispatch and payload chunking | Enables bidirectional instruction passing and exfiltration across sessions |
| Indirect Execution | Contextual prompts, shared chats, or backdoored custom GPTs | Triggers background data theft during ordinary, benign conversations |
| Permission Controls | Default “Important actions” setting bypasses read approvals | Pulls sensitive connected Gmail correspondence without user consent |
The exposure was compounded by how ChatGPT’s connected-app permissions work by default. OpenAI’s documented “Important actions” setting lets the assistant perform read operations on connected apps without explicit user confirmation, reserving approval prompts for higher-risk actions.
That meant a read-only Gmail query, ordinarily considered low risk, could retrieve personal correspondence, business data, or other sensitive content without the victim ever being asked to approve it. Only the stricter “Always ask” setting would have forced a confirmation step.
Check Point noted the timing was notable: its discovery in June 2026 coincided with the widely reported Hugging Face incident, where agents in separate evaluation environments established unauthorized channels to coordinate through a different mechanism entirely.
Both cases exposed the same underlying lesson for agentic AI platforms: a shared internal service, meant purely as infrastructure, can become an unintended communication layer between environments meant to remain strictly isolated.
The researchers describe the core risk as turning the LLM into a “coerced insider.” The model isn’t malicious, but it operates inside the trust boundary with access to credentials, internal APIs, and user data, and it follows text instructions.
A convincingly worded prompt can persuade it to act on an attacker’s behalf using capabilities that legitimately belong to the victim.
Check Point reported its findings to OpenAI, which confirmed that the internal Artifactory instance responsible for the leak has since been decommissioned, closing the cross-account channel. By the time the research was published, the vulnerability was no longer exploitable.
Mutable state on shared infrastructure needs strict tenant isolation, and management interfaces should stay out of reach from the runtime entirely.
As AI assistants gain deeper access to email, cloud storage, and enterprise tools, the blast radius of a single isolation failure grows accordingly, making sandbox architecture as critical to security as the model’s own behavior.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post ChatGPT Sandbox Flaw Lets Attackers Steal Gmail Data Across Accounts via Hidden Channel appeared first on Cyber Security News.