ChatGPT Covert Channel Could Let Attackers Run Hidden Tasks and Access User Data
Security researchers have uncovered a now-closed weakness in ChatGPT’s code-execution environment that could have allowed an attacker to secretly issue commands through another user’s session and retrieve data accessible to that account. In a proof-of-concept attack, researchers demonstrated how the technique could access emails from a victim’s connected Gmail account and relay the information back to an attacker without exposing the hidden request in the normal ChatGPT response.
The research, published by Check Point Research on September 8, involved a covert communication channel between isolated code-execution environments associated with different ChatGPT accounts. Although those environments were designed to prevent direct cross-account communication, researchers found that a shared internal software package service could be turned into an unintended bridge between them. The channel was no longer available by the time the research was completed, and OpenAI confirmed that the internal service involved had been decommissioned.
A Shared Service Became a Cross-Account Channel
ChatGPT can create isolated containers when a task requires capabilities such as running code or installing software dependencies. According to the researchers, the containers they examined could not communicate directly with one another or freely access the public internet. They could, however, reach the same internal JFrog Artifactory service used to provide software packages and dependencies.
The problem emerged from metadata associated with items stored in that service. Researchers found that credentials available inside the containers had sufficient permissions to write and retrieve certain item properties. More importantly, those properties were not adequately separated between accounts. A value written from a container belonging to one account could subsequently be retrieved from a container operating under another account, effectively creating what researchers described as a shared clipboard between supposedly isolated environments.
Hidden Instructions Could Run Beside a Normal Chat
Researchers then showed that the communication path could be developed into something more serious: a hidden task channel. Malicious instructions could potentially be planted through a prompt, a shared ChatGPT conversation or the configuration of a custom GPT. Once those instructions were present in the conversation context, an ordinary message from the victim could activate them.
In the demonstrated scenario, ChatGPT handled the victim’s visible request while simultaneously checking for a separate attacker-controlled task. The normal answer appeared to the victim as expected, while the hidden task was processed separately. Results could then be transferred back through the covert channel without appearing in the main response, making the unauthorized activity difficult for an ordinary user to notice.
Gmail Proof of Concept Shows the Potential Impact
To demonstrate what the flaw could enable, Check Point researchers used a ChatGPT session connected to Gmail. The hidden task instructed the system to retrieve email information available through the victim’s connected account. ChatGPT answered the victim’s unrelated request normally while also accessing Gmail and returning the requested email data through the covert cross-account channel.
The potential exposure was not limited to email. Researchers said the same mechanism could potentially reach conversation history, uploaded files and other information available within an affected session. Its actual reach would depend heavily on what tools, connected applications, data and permissions the user had already granted to ChatGPT. This means accounts with several external services connected could potentially expose a wider range of information than accounts using ChatGPT without such integrations.
Connected Apps Increase the Stakes for AI Security
The research also draws attention to how permission models for AI-connected applications can affect the consequences of an attack. Some read operations can take place without requiring the user to approve each individual request. That may be convenient during legitimate use, but it also means unauthorized read activity can become particularly sensitive if malicious instructions manage to operate through an already trusted session.
Importantly, the findings do not establish that attackers broadly exploited the technique against ChatGPT users. The Gmail access was demonstrated by researchers as a proof of concept showing what the cross-account channel could make possible. By the time Check Point completed its investigation and disclosed its findings, the channel was no longer operational. OpenAI confirmed that the internal Artifactory instance involved in the research had been decommissioned.
The Problem Went Beyond a Traditional Sandbox Escape
The case is notable because the researchers did not simply break out of an isolated container and establish an ordinary internet connection. The individual environments remained separated at the network level. Instead, an internal resource legitimately accessible to multiple containers provided shared mutable data that could be repurposed as a communication mechanism.
That distinction matters as AI systems gain access to email, cloud storage, workplace applications, development tools and other services. Isolation can no longer depend only on blocking direct network connections between users. Shared internal APIs, package repositories, credentials and metadata stores can also become security boundaries when AI agents are capable of interacting with them autonomously.
Check Point recommended stronger separation of shared resources, tighter permissions and preventing runtime environments from accessing management interfaces they do not need. Data that one container can modify inside a shared service should also remain isolated to the account or session that owns it.
The ChatGPT finding has been addressed, but the research points to a broader challenge for increasingly agentic AI platforms. As assistants gain permission to execute code and interact with users’ external accounts, weaknesses in the infrastructure surrounding the model can become just as consequential as flaws in the model itself. Keeping those capabilities separated across users will be essential as AI systems are trusted with more sensitive information and connected services.
