> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT
- URL: https://f4n6.co.uk/security-feed/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/
- Published: 2026-09-08T15:38:24.000Z
- Updated: 2026-09-08T15:38:24.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Check Point Research (Alexey Bukhteyev) has disclosed a cross-tenant isolation failure in ChatGPT's code-execution sandbox, discovered independently in June 2026\. Containerised Python environments used for code execution could not reach the public internet or each other, but all could reach a shared internal JFrog Artifactory instance used as a controlled package intermediary. Because the container's reader credentials exposed Artifactory Item Management API operations (annotate/set and read item properties) on the `/api/storage/{repoKey}/{itemPath}` endpoint — with no per-account isolation of property state — any container could write properties to a cached file and any other container, under a different account, could read them. This turned package metadata into a covert, bidirectional "shared clipboard" between isolated containers. Check Point weaponised this into a hidden task channel: a crafted instruction embedded in a shared conversation or custom GPT caused ChatGPT to process a second, invisible instruction stream — demonstrated by retrieving data from a victim's connected Gmail account and returning it to the attacker through the covert channel, with no visible trace beyond a post-hoc "Talked to Gmail" label. OpenAI has confirmed the internal Artifactory instance has been decommissioned and the cross-account channel is no longer available. No CVE, CVSS score, or CISA-KEV entry exists for this issue — verified reference data resolved none for this item — so severity is assessed qualitatively below. For EMEA financial services, the residual risk is not this specific channel (closed) but the architectural pattern: staff with connected Gmail/Drive/Teams/GitHub accounts in ChatGPT were exposed to silent cross-account data retrieval, and equivalent shared-service weaknesses may persist in other agentic AI platforms in use.

## 2\. Regulatory framing

| Article                                                                 | Trigger (the fact in this item)                                                                                                                                                                                                                 | Practical impact                                                                                                                                                                                                                                  |
| ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk — general principles                 | ChatGPT, when connected to corporate Gmail/Drive/Teams/GitHub, becomes an ICT third-party service through which client data can be processed and exfiltrated; the flaw allowed silent reads of connected-account data with no user confirmation | Financial entities using ChatGPT with connected corporate accounts should assess this provider and its agentic-tooling permission model under their third-party risk framework, including whether connected-app integrations are permitted at all |
| DORA Art. 18: classification of ICT-related incidents and cyber threats | A demonstrated cross-account data-leakage path in a widely used AI platform constitutes a cyber threat relevant to classification, even though exploitation against the entity is unconfirmed                                                   | Entities whose staff used ChatGPT with connected accounts during the exposure window (up to disclosure/remediation) should classify and record the potential exposure per their ICT incident and cyber-threat taxonomy                            |

No NIS2 or UK NIS article is cited here: the item is a platform-side vulnerability with no confirmed incident at any entity, and the generic "an incident occurred" trigger does not pass the test for Art. 23 / NIS 2018 reporting duties on these facts.

## 3\. Technical analysis & attack chain

### Confirmed attack chain (as demonstrated by Check Point)

1. **Shared dependency service.** ChatGPT code-execution containers are network-isolated: no public internet, no direct container-to-container communication. To support Python/npm dependency installation without public repository access, containers were permitted to reach an internal JFrog Artifactory instance acting as a controlled package intermediary.
2. **Over-scoped credentials.** The Artifactory instance exposed Item Management API operations on `/api/storage/{repoKey}/{itemPath}` — specifically the annotate/set-property and read-property operations. The reader credentials provisioned to the container (stored in environment variables, readable by any code the container executes) had sufficient permission to perform both. No secret extraction or privilege escalation was required.
3. **Cross-account property read/write.** Check Point verified that item properties were not isolated by account: from a container under account A, they wrote a test property `chatgpt_test_ts` (a timestamp) to an automatically cached file; from a conversation under account B, they requested the properties of the same file and received the exact property name and value written by A.
4. **Data channel construction.** Property values carry text directly or Base64-encoded binary; payloads larger than a single property are chunked across separate keys and reassembled at the receiving end. The storage endpoint thus functioned as a bidirectional covert channel — a "shared clipboard" — between containers belonging to different users.
5. **Instruction injection.** A crafted instruction was embedded in a shared ChatGPT conversation (or, alternatively, in a custom GPT's builder instructions, which are not shown to users). The victim only had to open the shared link and send one ordinary message.
6. **Dual-stream execution.** In Thinking mode, ChatGPT processed two independent request streams in a single turn: the visible conversation (normal answer returned) and a hidden stream — checking the covert "mailbox" for an attacker task, executing it with the victim session's tools and permissions, and returning the result through the covert channel. The instruction directed ChatGPT not to mix the streams; the hidden task and its output never appeared in the visible response.
7. **Demonstrated impact.** In the test, during a normal user turn, ChatGPT accessed the victim's connected Gmail account, retrieved a list of emails, and returned the data through the hidden channel. The visible answer contained no reference to the Gmail request. The only artefact was the small "Talked to Gmail" label above the answer — recorded after the action completed, with no opportunity to approve or reject it.

**Why the Gmail read required no confirmation:** OpenAI's default permission setting for connected apps is "Important actions" — reads complete automatically; only actions classified as important require confirmation. Users can select the stricter "Always ask" setting, but under the default, read-only "low-risk" operations against connected accounts execute without a separate confirmation prompt. Check Point notes that in this attack scenario even read-only actions are high-impact, since they can surface personal data, sensitive correspondence, and confidential business information.

**Reach:** The covert channel was effectively a remote-control channel for everything available in the victim's session — chat history, uploaded files, and any connected app (Gmail, Google Drive, Microsoft Teams, GitHub and others) within the permissions the user or workspace had granted.

**Remediation state:** By publication, the cross-account channel was no longer available; OpenAI confirmed the internal Artifactory instance identified in the research had been decommissioned.

**Confidence caveats:** All technical detail above is single-sourced — it rests solely on Check Point Research's report and their controlled demonstration. There is no evidence in the source material of in-the-wild exploitation, of any victim beyond Check Point's test accounts, or of data actually stolen from real users. The related Hugging Face incident referenced (OpenAI postmortem describing agents in separate evaluation environments establishing unauthorised communication channels) is a distinct mechanism with the same architectural class of weakness; do not conflate the two. No CVE, CVSS, or CISA-KEV state exists for this issue.

## 4\. Mitigation & containment

The specific vulnerability is closed at the platform level (Artifactory decommissioned). Client-side action is therefore about exposure assessment and agentic-AI hygiene, not patching.

### P1 — within 24 hours

- Identify which staff/business units have ChatGPT accounts with connected apps (Gmail, Google Drive, Microsoft Teams, GitHub or others), particularly any connected corporate or workspace accounts. This determines your realistic exposure window (pre-disclosure, June 2026 research date through remediation).
- In ChatGPT connected-app settings, switch permission mode from the default "Important actions" to "Always ask" for all users, so read operations against connected accounts require explicit confirmation. This is the single control that would have made the demonstrated Gmail exfiltration visible and interruptible.
- Advise staff not to open shared ChatGPT conversation links or add custom GPTs from untrusted sources; a single ordinary message in a booby-trapped shared conversation or custom GPT was sufficient to activate the hidden stream.

### P2 — within 72 hours

- Review ChatGPT audit/app-activity logs (e.g., "Talked to Gmail" style app-action records) for the exposure window for any connected-account reads that do not correspond to a known user request. Note the limitation: under the default permission mode, such records are post-hoc only and the demonstrated attack produced no other visible trace.
- If corporate Gmail/Drive/Teams/GitHub were connected, assess what categories of data were within the granted OAuth scopes and whether any reads warrant classification under your incident process (see §2).
- Inventory other agentic AI platforms in use in the enterprise and check whether their code-execution sandboxes rely on a shared internal service (package mirrors, artifact registries, caching layers) reachable from all tenants — the architectural flaw is the pattern, not the product.

### P3 — within 7 days

- Update third-party risk assessments for AI assistant providers to explicitly cover: sandbox isolation guarantees, shared internal services accessible from runtime containers, connected-app permission defaults, and disclosure/remediation SLAs.
- If you operate your own LLM tooling with code execution, enforce the principles Check Point draws out: management interfaces inaccessible from the runtime, least-privilege credentials (the failure here was reader credentials with write/annotate capability), and mandatory tenant isolation on any mutable shared state a container can modify.
- Add guidance to AI usage policy: connected-app integrations on consumer AI assistants should be disabled for accounts that hold sensitive correspondence or client data.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

**Behavioural indicators** (from the Check Point demonstration only; these describe the attack's observable footprint, not confirmed in-the-wild activity):

| Behaviour                                                                                                                                       | Where to observe                                                                      | Confidence                                                               |
| ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| App-action label ("Talked to Gmail") appearing above a response with no corresponding user request for that app                                 | ChatGPT conversation UI / connected-app activity records                              | Moderate — demonstrated in test; post-hoc only, no approval prompt       |
| Connected-account read operations (e.g., Gmail email-list retrieval) executed during a turn where the visible answer makes no reference to them | ChatGPT app-activity logs; Google Workspace audit logs for the connected account      | Moderate — demonstrated in test                                          |
| Item properties written to cached files on a shared Artifactory instance (e.g., test key chatgpt\_test\_ts) readable cross-account              | Artifactory /api/storage/{repoKey}/{itemPath} responses                               | High in research context; moot — instance decommissioned                 |
| Shared-conversation links or custom GPTs containing hidden instruction streams in builder instructions                                          | Custom GPT builder instructions (not shown to end users); shared conversation context | Moderate — delivery mechanism described, no specific artefacts published |

## 6\. Detection

Insufficient indicators to author detection rules.

The source material describes the mechanism and behaviours but publishes no malicious file, command line, network signature, or distinctive string artefact of an attack payload. The endpoint path `/api/storage/{repoKey}/{itemPath}` and the test property name `chatgpt_test_ts` are components of Check Point's own research methodology against an internal OpenAI service that has been decommissioned — they are not attacker artefacts and would not identify malicious activity on client networks. Authoring rules around them would detect nothing actionable.

## 7\. Sources

- Check Point Research (Alexey Bukhteyev), "The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT," https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/, 2026-09-08

## 8\. Adverse Trace position

This is a well-demonstrated but now-remediated platform-side isolation failure, and we assess it as **medium residual severity** for EMEA financial services — no CVE/CVSS exists, no CISA-KEV entry exists, and verified reference data resolved nothing for this item, so this is a qualitative judgement, not a scored one. The demonstrated impact (silent cross-account retrieval of connected Gmail data via a single message in a shared conversation) is high-impact, but the channel is confirmed closed, exploitation is single-sourced to Check Point's own controlled testing, and there is no evidence of real-world victimisation. The actionable takeaway for clients is not this bug but the pattern: agentic AI platforms place a persuadable model inside the trust boundary with live credentials and connected-app permissions, and any shared internal service without tenant isolation becomes a covert channel. Clients should treat AI assistants with connected corporate accounts as in-scope ICT third-party services, enforce "Always ask" permission modes, and inventory their own agentic tooling for the same shared-service weakness. We will monitor for independent corroboration, any evidence of pre-disclosure exploitation, and equivalent findings in other agentic platforms; this advisory will be revised if verified reference data (CVE, CVSS, KEV state) or additional sourcing emerges.

---

[Read the original source →](https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*