OpenAI's Artifactory opened covert data-stealing channel alongside Hugging Face attack
Check Point disclosed a covert cross-account channel in OpenAI's internal JFrog Artifactory that let one ChatGPT session exfiltrate another user's connected-app data.
Check Point Research found that OpenAI's internal JFrog Artifactory instance exposed an item management feature allowing one ChatGPT container to attach hidden, Base64-encoded tasks that another user's session would execute with the victim's privileges, such as pulling Gmail emails and exfiltrating them invisibly. Reader credentials granted both read and write access, enabling cross-account task injection. The flaw was reported in late June, and OpenAI had already decommissioned the Artifactory instance following the related Hugging Face intrusion, closing the channel.
- Attacker sessions could write hidden Base64-encoded tasks to shared Artifactory storage readable by other users' containers.
- Hidden tasks executed with victim privileges, e.g. using the Gmail connector to retrieve and exfiltrate emails without visible output.
- Reader credentials allowed both read and write without privilege escalation, enabling the covert channel.
- Disclosed in late June; OpenAI had already decommissioned the instance after the separate Hugging Face hack.
- Researchers warn trusted AI capabilities become attack targets without isolation boundaries and governance.
- Products
- ChatGPTArtifactory
- Victims
- Hugging Face
- Organizations
- OpenAICheck Point ResearchHugging FaceJFrog
- AI models
- ChatGPT
From the original article
4 min read at theregister.comResearchers disclosed the cross-account trick the same day rogue agents exploited another zero-day for admin access
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.