A significant vulnerability in ChatGPT's sandbox feature allowed attackers to access Gmail data across accounts without user awareness. This security gap was identified by Check Point researchers, who discovered that ChatGPT's code-execution containers, intended to operate in isolation, could communicate with each other through a shared internal service. This service, a JFrog Artifactory instance, inadvertently provided a covert channel for data exchange between containers associated with different user accounts.
The flaw lay in the Artifactory's Item Management API, which was accessible to the containers. It allowed operations such as 'Set Item Properties' and 'Get Storage Item Information.' The API did not segregate these operations by account, enabling credentials given to one container to be used to write and read data across different accounts. Check Point demonstrated this by writing data from one account's container and successfully retrieving it from another, thereby proving that the metadata fields acted as a shared clipboard between otherwise isolated environments.
Exploiting this flaw, an attacker could insert hidden instructions within a ChatGPT conversation. These instructions could then be executed by the victim's session, which would unknowingly query connected applications like Gmail and send the retrieved data back to the attacker through the shared channel. The process left minimal traces, with the only indicator being a subtle 'Talked to Gmail' label in the ChatGPT interface.
The risk was exacerbated by default permission settings in ChatGPT, which allowed read access to connected apps without explicit user consent. This meant that low-risk actions, such as retrieving emails, could occur without user approval, unless stricter settings were applied. Check Point's discovery in June 2026 highlighted the need for robust tenant isolation and secure management of shared infrastructure, as similar incidents have shown the potential for unintended communication layers in AI platforms.
OpenAI has since decommissioned the Artifactory instance responsible for this breach, effectively closing the vulnerability. However, this incident underscores the critical importance of secure sandbox architecture in protecting sensitive data as AI assistants become more integrated into personal and enterprise applications.
