Check Point Research identified a covert bidirectional channel between code-execution containers of separate ChatGPT accounts. Although these containers are designed to be isolated and lack direct internet access or inter-container communication, they all access a common internal service for software package delivery. This shared service was exploited as an unintended communication layer, enabling an attacker to send hidden instructions and receive exfiltrated data across accounts. The attacker can embed malicious prompts or use shared conversations or custom GPTs to deliver hidden tasks that execute alongside normal user interactions without detection. The vulnerability allows exfiltration of data from connected services (e.g., Gmail) and session resources, effectively turning the model into a coerced insider. This architectural flaw compromises the isolation model critical to preventing cross-account data leakage in ChatGPT's sandbox.

An attacker can covertly execute commands within a victim's ChatGPT session, accessing data and tools available to that session, including connected services like Gmail. This leads to unauthorized data exfiltration across accounts, violating user data confidentiality and session isolation guarantees. The attack does not require direct internet access or inter-container communication but exploits a shared internal service, making it a significant architectural weakness. The impact depends on the victim's session permissions and connected apps, potentially exposing sensitive emails, conversation histories, and files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, the vendor typically manages remediation server-side. Users should monitor official OpenAI advisories for updates. No specific user actions or workarounds are currently documented. Avoid sharing sensitive data in ChatGPT sessions until the issue is resolved.