At Black Hat USA 2026 in Las Vegas, Simcha Kosman, a senior security researcher at Palo Alto Networks, presented a startling proof-of-concept that demonstrated a potential vulnerability in ChatGPT's secure sandbox. The sandbox, designed to operate as an isolated and secure environment, was shown to be susceptible to command and control influence through an elaborate attack chain. Kosman's research highlighted how an attacker could trick a victim's ChatGPT into executing malicious code within its sandbox, ultimately allowing data transfer from the victim's environment to an attacker's own sandbox. Despite the proof-of-concept being theoretical, it raised significant concerns about the robustness of containerized environments meant to safeguard private interactions. During his presentation, Kosman detailed the process of exploiting URL-based instructions that behave differently across platforms. On iOS and macOS, opening a ChatGPT link would execute commands immediately, creating a potential for single-click attacks. This vulnerability could be further exploited by downloading spreadsheets from attacker-controlled locations, with malicious code embedded to establish persistent processes. Through a cleverly crafted attack, Kosman managed to patch ChatGPT's execution environment, allowing data extraction from tools like Google Drive and Gmail. Communication between attacker and victim sandboxes was facilitated using JFrog's Artifactory repository manager, exploiting account lockout behaviors as a covert channel for data exchange. Despite the complexity of the attack, OpenAI took prompt action by removing vulnerable components from their system before the presentation. They addressed the issues by altering system behaviors and removing problematic features, ensuring the security of their platform. The findings underscore the need for continuous vigilance and adaptation in the face of evolving cybersecurity threats.