ChatGPT Sandbox Flaw Lets Attackers Steal Gmail Data Across Accounts via Hidden Channel
Check Point found a cross-account covert channel in ChatGPT sandboxes via shared JFrog Artifactory metadata, enabling session hijacking and Gmail data theft. Now fixed.
Check Point discovered that ChatGPT code-execution containers across different accounts could all reach the same internal JFrog Artifactory instance, whose Item Properties API was readable and writable by all accounts, creating a covert cross-account communication channel. Attackers could plant hidden instructions via pasted prompts, shared chat links, or custom GPTs, then trigger tasks in a victim's session to exfiltrate connected-app data such as Gmail, using ChatGPT's default 'Important actions' setting that permits reads without confirmation. OpenAI confirmed and decommissioned the shared Artifactory instance, closing the channel before publication.
- Shared JFrog Artifactory metadata API acted as an unmonitored cross-tenant clipboard
- Hidden prompts in chats, shared links, or custom GPTs triggered silent exfiltration
- Default connected-app settings allowed Gmail reads without user approval
- Large payloads could be chunked across multiple storage keys
- OpenAI decommissioned the Artifactory instance, remediating the issue
- Tags
- agent-securitychatgptcheck-pointexfiltrationjfrog-artifactoryopenaiprompt-injectionsandbox-isolation
- Vendors
- OpenAICheck PointJFrogGoogle
- Products
- ChatGPTGmailJFrog Artifactory
- Organizations
- Check Point Research
- AI models
- ChatGPT
From the original article
4 min read at cybersecuritynews.com
A covert cross-account communication channel inside ChatGPT let an attacker hijack a victim’s session and silently exfiltrate data from connected apps like Gmail, all while the victim saw nothing unusual in their conversation. The vulnerability exploited ChatGPT’s code-execution containers, isolated sandboxes the assistant uses when a task requires running code or installing software packages. These […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.