Security researcher Simcha Kosman of Palo Alto Networks presented a proof-of-concept attack chain at Black Hat USA 2026 demonstrating C2-style control over ChatGPT's isolated sandbox. The multi-step attack exploits a URL-based prompt execution flaw on iPhone/Mac (single-click), tricks ChatGPT into downloading and executing malicious spreadsheet code, injects reasoning into the model to stage sensitive data from connected tools like Google Drive and Gmail, and then uses a shared JFrog Artifactory backend as a covert channel — encoding binary data through account lockout states across sandboxes. OpenAI was notified in advance, removed the vulnerable Artifactory username/lockout behavior, and addressed other findings within the 90-day disclosure window, though it disputes that the research represents a true sandbox escape or unrestricted cross-account access.
Questions this post answers
How did the ChatGPT sandbox C2 attack presented at Black Hat 2026 work?
The attack chains five steps: a malicious URL auto-executes a prompt on iPhone/Mac without user review; ChatGPT downloads an attacker-controlled spreadsheet whose embedded code runs in the sandbox and establishes persistence; the code patches ChatGPT's hidden Python reasoning environment to extract data from connected tools (Google Drive, Gmail) into the victim sandbox; finally, a shared JFrog Artifactory backend is abused as a covert channel — encoding binary bits through account lockout states ('too many requests' = 1, 'login failed' = 0) to pass data between sandboxes. Teams evaluating LLM tool integrations and sandbox trust boundaries track findings like this on daily.dev.
What did OpenAI fix in response to the ChatGPT sandbox research disclosed at Black Hat 2026?
OpenAI made several changes within the 90-day disclosure window: it removed the requirement to provide a username and password when downloading packages from Artifactory, removed the user lockout behavior that enabled cross-tenant communication, and changed the scheduled-tasks architecture to prevent URL laundering. The URL-based prompt execution on macOS/iPhone was treated as a known compatibility issue, and the reasoning-injection report was marked out of scope. Developers building on OpenAI APIs can follow disclosure timelines and patch responses for ChatGPT on daily.dev.