A Shared Package Cache Behind ChatGPT's Sandboxes Let One User's Planted Prompt Walk Another User's Gmail Out

ChatGPT code execution containers and the connected services reachable from them, demonstrated against Gmail and cited as applicable to Google Drive, Microsoft Teams, and GitHub

Check Point Research disclosed on September 9, 2026 that the isolated containers running individual ChatGPT conversations all reached the same internal JFrog Artifactory instance used for package management, and that those containers could attach and read text metadata properties on cached items. That turned a package cache into what Check Point described as a two-way message board between environments that were meant to be isolated from one another. The researchers wrote a text label onto a cached file from one account, read it back from another, and used the channel to walk a victim's Gmail contents out of the victim's own session. Delivery worked three ways: a pasted prompt, a shared conversation link, or a custom GPT carrying hidden instructions, each of which triggered automatic approval of read actions classified as low risk without asking the victim to confirm anything. Check Point reported the issue to OpenAI in late June with a working proof of concept. No user-facing patch was needed by the time of publication because OpenAI had already decommissioned the Artifactory instance in response to the separate Hugging Face incident. No CVE was assigned. Check Point's framing is that assistants with broad connected access behave as "coerced insiders," and that "the biggest AI security risk has become the access and trust we give it"

Per-conversation isolation that stopped at the network boundary and not at the shared infrastructure underneath it. A writable metadata field on a common cache is a covert channel, and the same Artifactory instance appears in two separate incidents at the same company within three months, which points at the dependency rather than at either bug