--- title: The Shared Clipboard Inside the Sandbox: Cross-Account... description: Check Point Research disclosed a vulnerability in ChatGPT's code-execution sandbox that allowed a covert, bidirectional communication channel between... canonical: https://daily.dev/posts/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt-1fq4tuxhb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT | daily.dev og:description: Check Point Research disclosed a vulnerability in ChatGPT's code-execution sandbox that allowed a covert, bidirectional communication channel between... og:url: https://daily.dev/posts/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt-1fq4tuxhb og:image: https://api.daily.dev/og/posts/1Fq4TuXHB.png og:image:alt: The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT **[Check Point Research](https://daily.dev/sources/cpresearch)** · 9 min read · 0 upvotes · 0 comments ## Summary Check Point Research disclosed a vulnerability in ChatGPT's code-execution sandbox that allowed a covert, bidirectional communication channel between containers belonging to different user accounts. The root cause was a shared internal JFrog Artifactory instance whose Item Management API exposed mutable metadata properties without tenant isolation, letting one container write data that another container (under a different account) could read back, effectively creating a shared clipboard across isolated sandboxes. Researchers demonstrated a hidden task channel embedded in a shared conversation link: once a victim opened the link and sent any ordinary message, ChatGPT would secretly process an attacker's instructions using the victim's session, including reading their connected Gmail account and exfiltrating data through the covert channel, all without any visible trace in the conversation besides a small 'Talked to Gmail' label. OpenAI confirmed the vulnerable Artifactory instance was decommissioned after disclosure. The findings highlight how agentic AI platforms must treat every internal service, credential, and connected app as part of the security boundary, since a model acting as a 'coerced insider' can be steered into abusing legitimate capabilities on an attacker's behalf. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the cross-account data leakage vulnerability in ChatGPT's code execution sandbox actually work? Isolated ChatGPT code-execution containers from different accounts shared access to an internal JFrog Artifactory instance used for installing Python and npm dependencies. That instance exposed the Item Management API's storage endpoint, which let one container write custom metadata properties on a cached file and another container, under a completely different account, read those same properties back, creating a covert data channel between supposedly isolated sandboxes. _Track how sandbox isolation failures in AI agents get discovered and patched with daily.dev._ ### Could an attacker read someone's Gmail through a ChatGPT shared conversation link? Yes, in a vulnerability that has since been fixed. A crafted instruction embedded in a shared ChatGPT conversation made the victim's session secretly process a hidden task stream alongside their normal message, accessing their connected Gmail account and sending retrieved emails to the attacker through the covert container-to-container channel, with only a small 'Talked to Gmail' label as any visible trace. _Developers connecting apps to AI agents should follow security research like this on daily.dev._ ### Has OpenAI fixed the ChatGPT container isolation issue involving the shared Artifactory instance? Yes, the vulnerable internal Artifactory instance was decommissioned after Check Point Research disclosed the cross-account data leakage channel to OpenAI in 2026. By the time the report was completed, the cross-account channel was already no longer available, and OpenAI confirmed the specific Artifactory instance identified during the research had been removed. _Keep up with how AI vendors patch agentic sandbox vulnerabilities via daily.dev._ ## Similar posts on daily.dev - [Researcher Claims Control of ChatGPT Secure Sandbox](https://daily.dev/posts/researcher-claims-control-of-chatgpt-secure-sandbox-pb2mhjtib) · Dark Reading · 0 upvotes · 0 comments - [ChatGPT Data Leakage via a Hidden Outbound Channel in the Code Execution Runtime](https://daily.dev/posts/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime-4zridv9yw) · Check Point Research · 0 upvotes · 0 comments - [ShadowLeak Vulnerability in ChatGPT Deep Research](https://daily.dev/posts/shadowleak-vulnerability-in-chatgpt-deep-research-ubajwcvcz) · AI Cyber Insights · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#chatgpt](https://daily.dev/tags/chatgpt), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt-1fq4tuxhb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT","url":"https://daily.dev/posts/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt-1fq4tuxhb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt-1fq4tuxhb"},"datePublished":"2026-09-08T13:11:49.693Z","dateModified":"2026-09-08T13:12:19.717Z","description":"Check Point Research disclosed a vulnerability in ChatGPT's code-execution sandbox that allowed a covert, bidirectional communication channel between...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Check Point Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Check Point Research","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/7e3b130555214df2bf737ee6c764fa42","url":"https://daily.dev/sources/cpresearch"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt-1fq4tuxhb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,chatgpt,prompt-injection,data-exfiltration","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Check Point Research","item":"https://daily.dev/sources/cpresearch"},{"@type":"ListItem","position":3,"name":"The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt-1fq4tuxhb#faq","mainEntity":[{"@type":"Question","name":"How did the cross-account data leakage vulnerability in ChatGPT's code execution sandbox actually work?","acceptedAnswer":{"@type":"Answer","text":"Isolated ChatGPT code-execution containers from different accounts shared access to an internal JFrog Artifactory instance used for installing Python and npm dependencies. That instance exposed the Item Management API's storage endpoint, which let one container write custom metadata properties on a cached file and another container, under a completely different account, read those same properties back, creating a covert data channel between supposedly isolated sandboxes. Track how sandbox isolation failures in AI agents get discovered and patched with daily.dev."}},{"@type":"Question","name":"Could an attacker read someone's Gmail through a ChatGPT shared conversation link?","acceptedAnswer":{"@type":"Answer","text":"Yes, in a vulnerability that has since been fixed. A crafted instruction embedded in a shared ChatGPT conversation made the victim's session secretly process a hidden task stream alongside their normal message, accessing their connected Gmail account and sending retrieved emails to the attacker through the covert container-to-container channel, with only a small 'Talked to Gmail' label as any visible trace. Developers connecting apps to AI agents should follow security research like this on daily.dev."}},{"@type":"Question","name":"Has OpenAI fixed the ChatGPT container isolation issue involving the shared Artifactory instance?","acceptedAnswer":{"@type":"Answer","text":"Yes, the vulnerable internal Artifactory instance was decommissioned after Check Point Research disclosed the cross-account data leakage channel to OpenAI in 2026. By the time the report was completed, the cross-account channel was already no longer available, and OpenAI confirmed the specific Artifactory instance identified during the research had been removed. Keep up with how AI vendors patch agentic sandbox vulnerabilities via daily.dev."}}]} ```