ChatGPT Sandbox Flaw Lets Attackers Steal Gmail Data Across Accounts via Hidden Channel

A covert cross-account communication channel inside ChatGPT let an attacker hijack a victim’s session and silently exfiltrate data from connected apps like Gmail, all while the victim saw nothing unusual in their conversation.

The vulnerability exploited ChatGPT’s code-execution containers , isolated sandboxes the assistant uses when a task requires running code or installing software packages.

These containers cannot reach the public internet directly and are not supposed to talk to containers spun up under different accounts.

However, Check Point researchers found that containers across accounts could all reach the same internal service: a JFrog Artifactory instance used to deliver Python and npm packages. That shared dependency became the crack in the wall.