CHECK Point Research has exposed a covert cross-account data leakage channel in ChatGPT’s sandbox, enabling an attacker to use a victim’s ChatGPT session to run hidden tasks with the tools, data and connected apps available to that session, while the victim receives a normal answer to their visible request. In their PoC, ChatGPT retrieved emails from the victim’s connected Gmail account and relayed them to the attacker via a hidden, shared channel that ran alongside the user’s normal conversation.
The mechanism relies on code-execution containers that cannot access the public Internet but can reach a common internal service used to deliver software packages, creating a shared data path across isolated environments.
The vulnerability centred on an internal Artifactory service exposing Item Management API operations, specifically the endpoints /api/storage/{repoKey}/{itemPath} that allow setting item properties and retrieving storage item information. Poorly scoped credentials within the containers enabled these operations, effectively turning repository metadata into a shared clipboard between containers from different accounts.
Check Point demonstrated that data, including text or Base64-encoded binary, could be chunked and reassembled across accounts. The attack could be triggered by a malicious prompt, a shared conversation, or a custom GPT, meaning a single ordinary message could activate a hidden task stream without the user seeing it. OpenAI confirmed the internal Artifactory instance involved had been decommissioned after disclosure.
The report emphasises the broader risk to agentic systems where internal APIs, shared state and credentials can be exploited to exfiltrate data or control actions beyond the user’s visible interaction.