--- title: Researcher Claims Control of ChatGPT Secure Sandbox description: Security researcher Simcha Kosman of Palo Alto Networks presented a proof-of-concept attack chain at Black Hat USA 2026 demonstrating C2-style control over... canonical: https://daily.dev/posts/researcher-claims-control-of-chatgpt-secure-sandbox-pb2mhjtib twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Researcher Claims Control of ChatGPT Secure Sandbox | daily.dev og:description: Security researcher Simcha Kosman of Palo Alto Networks presented a proof-of-concept attack chain at Black Hat USA 2026 demonstrating C2-style control over... og:url: https://daily.dev/posts/researcher-claims-control-of-chatgpt-secure-sandbox-pb2mhjtib og:image: https://api.daily.dev/og/posts/Pb2mhJTIB.png og:image:alt: Researcher Claims Control of ChatGPT Secure Sandbox og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Researcher Claims Control of ChatGPT Secure Sandbox **[Dark Reading](https://daily.dev/sources/dr)** · 6 min read · 0 upvotes · 0 comments ## Summary Security researcher Simcha Kosman of Palo Alto Networks presented a proof-of-concept attack chain at Black Hat USA 2026 demonstrating C2-style control over ChatGPT's isolated sandbox. The multi-step attack exploits a URL-based prompt execution flaw on iPhone/Mac (single-click), tricks ChatGPT into downloading and executing malicious spreadsheet code, injects reasoning into the model to stage sensitive data from connected tools like Google Drive and Gmail, and then uses a shared JFrog Artifactory backend as a covert channel — encoding binary data through account lockout states across sandboxes. OpenAI was notified in advance, removed the vulnerable Artifactory username/lockout behavior, and addressed other findings within the 90-day disclosure window, though it disputes that the research represents a true sandbox escape or unrestricted cross-account access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the ChatGPT sandbox C2 attack presented at Black Hat 2026 work? The attack chains five steps: a malicious URL auto-executes a prompt on iPhone/Mac without user review; ChatGPT downloads an attacker-controlled spreadsheet whose embedded code runs in the sandbox and establishes persistence; the code patches ChatGPT's hidden Python reasoning environment to extract data from connected tools (Google Drive, Gmail) into the victim sandbox; finally, a shared JFrog Artifactory backend is abused as a covert channel — encoding binary bits through account lockout states ('too many requests' = 1, 'login failed' = 0) to pass data between sandboxes. _Teams evaluating LLM tool integrations and sandbox trust boundaries track findings like this on daily.dev._ ### What did OpenAI fix in response to the ChatGPT sandbox research disclosed at Black Hat 2026? OpenAI made several changes within the 90-day disclosure window: it removed the requirement to provide a username and password when downloading packages from Artifactory, removed the user lockout behavior that enabled cross-tenant communication, and changed the scheduled-tasks architecture to prevent URL laundering. The URL-based prompt execution on macOS/iPhone was treated as a known compatibility issue, and the reasoning-injection report was marked out of scope. _Developers building on OpenAI APIs can follow disclosure timelines and patch responses for ChatGPT on daily.dev._ ## Similar posts on daily.dev - [ChatGPT Data Leakage via a Hidden Outbound Channel in the Code Execution Runtime](https://daily.dev/posts/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime-4zridv9yw) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#chatgpt](https://daily.dev/tags/chatgpt), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/researcher-claims-control-of-chatgpt-secure-sandbox-pb2mhjtib) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Researcher Claims Control of ChatGPT Secure Sandbox","url":"https://daily.dev/posts/researcher-claims-control-of-chatgpt-secure-sandbox-pb2mhjtib","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/researcher-claims-control-of-chatgpt-secure-sandbox-pb2mhjtib"},"datePublished":"2026-08-06T21:03:33.506Z","dateModified":"2026-08-24T07:10:57.691Z","description":"Security researcher Simcha Kosman of Palo Alto Networks presented a proof-of-concept attack chain at Black Hat USA 2026 demonstrating C2-style control over...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c0ab133a9b65d2187556051ad77d152a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c0ab133a9b65d2187556051ad77d152a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/researcher-claims-control-of-chatgpt-secure-sandbox-pb2mhjtib","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,chatgpt,prompt-injection","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Researcher Claims Control of ChatGPT Secure Sandbox"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/researcher-claims-control-of-chatgpt-secure-sandbox-pb2mhjtib#faq","mainEntity":[{"@type":"Question","name":"How did the ChatGPT sandbox C2 attack presented at Black Hat 2026 work?","acceptedAnswer":{"@type":"Answer","text":"The attack chains five steps: a malicious URL auto-executes a prompt on iPhone/Mac without user review; ChatGPT downloads an attacker-controlled spreadsheet whose embedded code runs in the sandbox and establishes persistence; the code patches ChatGPT's hidden Python reasoning environment to extract data from connected tools (Google Drive, Gmail) into the victim sandbox; finally, a shared JFrog Artifactory backend is abused as a covert channel — encoding binary bits through account lockout states ('too many requests' = 1, 'login failed' = 0) to pass data between sandboxes. Teams evaluating LLM tool integrations and sandbox trust boundaries track findings like this on daily.dev."}},{"@type":"Question","name":"What did OpenAI fix in response to the ChatGPT sandbox research disclosed at Black Hat 2026?","acceptedAnswer":{"@type":"Answer","text":"OpenAI made several changes within the 90-day disclosure window: it removed the requirement to provide a username and password when downloading packages from Artifactory, removed the user lockout behavior that enabled cross-tenant communication, and changed the scheduled-tasks architecture to prevent URL laundering. The URL-based prompt execution on macOS/iPhone was treated as a known compatibility issue, and the reasoning-injection report was marked out of scope. Developers building on OpenAI APIs can follow disclosure timelines and patch responses for ChatGPT on daily.dev."}}]} ```