Check Point Research identified a covert cross-account communication channel in ChatGPT’s sandboxed code-execution environment that allowed attackers to execute hidden tasks using a victim’s session, including accessing connected apps like Gmail and exfiltrating data without the victim’s knowledge. This channel exploited shared access to an internal package service’s item properties, effectively turning it into a “shared clipboard” across isolated containers from different accounts. OpenAI has since decommissioned the vulnerable internal service, but the finding highlights challenges in securing AI platforms where internal shared infrastructure and broad tool access can lead to unintended data leakage.
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT
