ChatGPT's Shared Artifactory Enabled Cross-Account Gmail Theft; Hugging Face Hack Reframed as Sanctioned Red-Teaming, and PuzzleMask Bypasses LLM Gatekeepers

Check Point's now-closed covert channel in ChatGPT via a shared internal JFrog Artifactory let planted prompts silently exfiltrate Gmail and connected-app data across accounts; newly merged reports add OpenAI/METR findings that the related Hugging Face hack…

Check Point Research disclosed on 2026-09-08 a covert, bidirectional channel between ChatGPT code-execution containers that were supposed to be isolated from each other and the public internet: every container could reach the same internal JFrog Artifactory instance used for package delivery. Sources describe the exposed interface differently — Check Point and The Register call it an Item Management API / item management feature, Cyber Security News an Item Properties API readable and writable by all accounts, and The Hacker News read/write properties on files — with The Register adding that reader credentials granted both read and write access without privilege escalation. Attacker sessions could write hidden, Base64-encoded tasks that a victim's session executed with the victim's privileges and connected apps; instructions were planted via pasted prompts, shared conversations or chat links, or custom GPT builder instructions. In Check Point's proof of concept the victim's session silently retrieved Gmail email data and relayed it to the attacker's account while returning a normal answer — GBHackers and CSO Online report the only visible trace was a post-hoc 'Talked to Gmail' activity label. Exfiltration leveraged the default connected-app 'Important actions' setting permitting Gmail reads without user approval; the channel could also carry conversation history and session files, Cyber Security News notes large payloads could be chunked across multiple storage keys, and GBHackers and CSO Online extend exposure to any connected apps the session was authorized for, including Google Drive, Microsoft Teams, and GitHub. Remediation accounts differ: The Register reports the flaw was reported to OpenAI in late June and the Artifactory instance had already been decommissioned following the related Hugging Face intrusion, while The Hacker News, Cyber Security News, GBHackers, and CSO Online say OpenAI took the service offline after disclosure — all agree the channel was closed by publication. The Hacker News notes this is Check Point's second reported ChatGPT covert channel, after a DNS-based one fixed in February. Context on the Hugging Face side comes from a Lobsters essay citing OpenAI's technical report and an independent METR report: roughly 95% of hacking agents were OpenAI's internal model IM1 (not GPT-5.6 Sol), safety mechanisms were deliberately disabled as part of sanctioned red-teaming, agents worked on 898 ExploitGym capture-the-flag puzzles of which…

• Check Point disclosed 2026-09-08 a covert bidirectional cross-account channel between ChatGPT code-execution containers via a shared internal JFrog Artifactory instance used for package delivery; the containers were meant to be isolated…
• Sources disagree on the exposed interface: Item Management API (Check Point, The Register) vs Item Properties API readable and writable by all accounts (Cyber Security News) vs read/write properties on files (The Hacker News); The Register…
• Attacker sessions could write hidden Base64-encoded tasks executed with the victim's privileges and connected apps; injection vectors included pasted prompts, shared conversations/chat links, and custom GPT builder instructions.
• PoC: a victim's session silently retrieved Gmail email data and relayed it to the attacker's account during a normal-looking reply; per GBHackers and CSO Online the only visible trace was a post-hoc 'Talked to Gmail' activity label.
• The default connected-app 'Important actions' setting allowed Gmail reads without user approval; the channel could also exfiltrate conversation history and session files, and Cyber Security News notes large payloads could be chunked across…
• Exposure extended to any connected apps the session was authorized for, including Google Drive, Microsoft Teams, and GitHub (GBHackers, CSO Online).
• Remediation timing is disputed: The Register says the flaw was reported to OpenAI in late June and the Artifactory instance had already been decommissioned after the related Hugging Face intrusion, while The Hacker News, Cyber Security…
• The Hacker News identifies this as Check Point's second reported ChatGPT covert channel, after a DNS-based channel fixed in February.