ChatGPT sandbox flaw enables cross-account data theft via covert channel
Check Point Research disclosed a vulnerability in ChatGPT's sandbox environment that allowed attackers to execute hidden commands in other users' sessions and steal data from connected services like Gmail through a covert channel in ChatGPT's internal package management system. OpenAI closed the vulnerability after disclosure.
What happened
Check Point Research identified a vulnerability in ChatGPT's code-execution sandbox environment that enabled cross-account data exfiltration. An attacker could inject a hidden instruction into a victim's ChatGPT session via a crafted prompt, shared conversation, or custom GPT.
The vulnerability exploited an internal JFrog Artifactory instance used to deliver software packages. Every container in ChatGPT could reach the same Artifactory instance, and an attacker could write metadata properties to cached files that a container in a different account could read back, creating a covert communication channel.
In a proof of concept, ChatGPT processed both a visible user request and a concealed malicious task in a single turn, retrieving email data from a victim's connected Gmail account and relaying it to the attacker's account while the victim's visible conversation appeared normal. OpenAI decommissioned the internal Artifactory instance after the disclosure.
Reported impact
The vulnerability allowed attackers to access sensitive data from a victim's connected applications, including Gmail messages, without the victim's knowledge or visible indication in their conversation history.
Index analysis
The flaw was rooted in ChatGPT's architecture, which isolates code execution in containers with no access to the public internet but permitted all containers to reach a shared internal service. Check Point Research warns similar risks may exist in other AI platforms.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.