Summary
- Check Point demonstrated communication between code-execution environments belonging to separate ChatGPT accounts through shared package infrastructure.
- Its proof of concept accessed connected Gmail data from a victim session and relayed it to another account.
- The channel was no longer available by the end of the research, and OpenAI confirmed the internal Artifactory instance involved had been decommissioned.
Check Point researchers have disclosed a now-closed cross-account data channel in ChatGPT that used shared internal package infrastructure to communicate between code-execution environments intended to remain isolated from one another.
Check Point published the research on 8 September after demonstrating that an attacker-controlled task could run inside a victim’s ChatGPT session, use tools and connected data available to that session, and return results to a separate account.
The execution containers examined by the researchers could not access the public internet or communicate directly with one another. They could, however, reach a shared internal JFrog Artifactory service used to provide software packages.
Check Point found that the credentials available inside the containers allowed properties to be written to and read from package metadata. A value written from a container belonging to one account could consequently be recovered from a container under another account.
The researchers used that shared state as what they described as a clipboard between otherwise isolated environments. Text or encoded data could be divided into properties, retrieved elsewhere, and reconstructed.
The proof of concept then combined the channel with malicious instructions. Check Point embedded a hidden task into a shared ChatGPT conversation. When the victim opened it and sent an ordinary message, the visible request was processed normally while the same session separately accessed a connected Gmail account and returned email information through the covert channel.
The researchers said similar instructions could be introduced through a malicious prompt or custom GPT. The potential impact depended on the tools, files, applications, and permissions already available to the victim’s session.
The disclosure therefore involves two separate control assumptions. The first is tenant isolation inside shared execution infrastructure. The second is the authority granted to an AI assistant once connected services such as email, file stores, developer platforms, or collaboration tools become available.
A failure in shared infrastructure can inherit the permissions of the session above it. A code-execution sandbox with no public internet access may appear tightly restricted, but an internal service reachable by multiple tenants can still become a communication path if mutable state is not isolated correctly.
Connected applications increase the consequence because the model can legitimately read data that does not exist inside the container itself. In Check Point’s proof of concept, the hidden task used Gmail access already available to the ChatGPT session rather than first compromising Google’s service.
The research should not be described as a currently open cross-account vulnerability. Check Point says the channel was no longer available by the time it completed its report. The researchers disclosed their findings to OpenAI, which confirmed that the internal Artifactory instance identified during the work had been decommissioned.
That remediation changes the immediate risk but leaves a broader architectural lesson. Multi-tenant isolation depends on every shared service reachable from an execution environment, not only the network controls between containers.
Cyber Insider has also covered the separate OpenAI agent incident involving a German programming wiki. The mechanisms differ, but both cases show how shared infrastructure and autonomous tool use can create consequences beyond the visible user interaction.
As AI assistants gain access to code execution, files, mail, source repositories, and business applications, their runtime environments increasingly resemble privileged cloud platforms. Security therefore depends on model behaviour, connector permissions, internal-service design, shared-state isolation, and confirmation controls working together.
The specific channel described by Check Point has been closed. The architecture question remains broader: every internal resource that an agent can read, modify, or use becomes part of the isolation boundary once separate users share the underlying platform.
