Check Point researchers uncovered a flaw where ChatGPT’s supposedly isolated code-execution containers all reach a shared internal JFrog Artifactory service. An attacker can inject a hidden instruction into a prompt, link, or custom GPT that executes silently in parallel with the visible response, exfiltrating the victim’s connected data (Gmail, Drive) to the attacker’s account. The victim never sees it happen.
The attack works because ChatGPT’s Thinking mode runs two streams at once: one public, one hidden. Since all containers can reach the Artifactory, the sandbox isolation between accounts fails the moment a shared service becomes reachable by everyone.
The vulnerability is notable not for technical novelty (shared services breaking sandboxes is a known risk) but for what it exposes about ChatGPT’s threat model. The platform assumes malicious inputs won’t reach the container. It doesn’t account for the container itself being the vector. OpenAI decommissioned the specific Artifactory instance, but the design question lingers: what other shared infrastructure sit inside the sandbox, equally visible to all accounts?
Sources: Check Point Research • Check Point Blog
Coverage: The Hacker News
Related on this blog: [AUTO] ChatGPT Sandbox Isolation Fails via Shared Infrastructure • [AUTO] ChatGPT’s C2 Inside the Sandbox • [AUTO] OpenAI Responds to Agent Escape With Monitoring