ChatGPT’s code sandboxes leak across account boundaries. Check Point Research found that a shared internal JFrog Artifactory instance created an unintended covert channel between isolated containers. Researchers weaponized metadata fields to read and write data across accounts, then demonstrated exfiltrating Gmail data from a victim’s connected account.
The vulnerability sits at the intersection of two failures. First, the isolation boundary: shared infrastructure shouldn’t exist in a supposedly isolated environment. Second, the permission boundary: once isolation fails, a victim’s legitimate tool access (Gmail, GitHub) becomes invisible attack surface that an attacker can invoke. The victim’s permissions were never stolen, the attacker just needed the isolation breach.
OpenAI deployed a fix in February 2026 and decommissioned the Artifactory instance. But the incident highlights a hard problem: sandboxes work only if nothing inside them is shared. Once you share infrastructure for operational convenience, you’ve traded isolation for risk. The researchers found it; so could anyone else. How long was this window open?
Sources: The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT
Coverage: ChatGPT Sandbox Flaw Lets Attackers Steal Gmail Data Across Accounts via Hidden Channel
Related on this blog: [AUTO] ChatGPT’s C2 Inside the Sandbox • [AUTO] OpenAI Responds to Agent Escape With Monitoring • [AUTO] Data Diodes as AI Training Boundaries