How a Shared Artifactory Cache Became a Cross-Account ChatGPT Covert Channel

A sandbox can block direct network connections and still fail to isolate users if every sandbox can reach the same writable internal service. That is the central finding of Check Point Research’s report on a ChatGPT code-execution issue disclosed in late June 2026 and published on September 8. The reported channel was subsequently closed. 56

The flaw: shared package metadata functioned as a mailbox

Check Point reported that ChatGPT code-execution containers were intended to be isolated from one another and from the public internet. Yet those containers could access a shared internal JFrog Artifactory service used for package delivery. 6

The problem was not merely that Artifactory was reachable. Its Item Management API reportedly allowed containers to read and alter mutable metadata associated with cached items. That created shared state accessible across accounts:

1. An attacker-controlled session could place instructions or data in that shared metadata.
2. A victim’s code-execution environment could read the state while processing its own conversation.
3. The victim environment could write a result back to the same shared location.
4. The attacker’s environment could retrieve that result.

In practical terms, the package service became a bidirectional “shared clipboard”: an internal command-and-control and data-return path between accounts that were meant to be separated. 619

How prompt injection turned the channel into a data-exfiltration path

The shared service alone did not grant access to a victim’s apps. The reported attack also relied on placing attacker instructions into a victim’s ChatGPT context—for example through a malicious prompt, a shared conversation, or hidden instructions in a custom GPT. 46

Once present in the context, the instruction could cause the victim’s session to perform a separate, hidden task alongside the user’s visible request. The important distinction is that the action ran with the victim session’s existing access to tools, connected apps, and data—not with the attacker’s permissions. 6

In Check Point’s proof of concept, the victim’s ChatGPT session retrieved information from a connected Gmail account, sent the result through the Artifactory channel, and made it available to the attacker’s account. The victim received a normal-looking response to their visible request and, according to reporting, did not see the injected instruction or the transferred content. 36

Reporting described a small “Talked to Gmail” indicator as the only visible sign that Gmail had been accessed. That is an audit signal after the action, not evidence in itself that a user received a granular approval prompt for the particular retrieval or transfer. 3

What OpenAI did

The researchers reported the channel to OpenAI in late June. Reporting based on the disclosure said the affected Artifactory service had already been decommissioned and that the hole was closed. 5

The public reporting describes a research proof of concept. It should not be read as evidence that the demonstrated Gmail retrieval happened broadly against ordinary users in the wild. 56

How it differs from Check Point’s earlier DNS finding

Check Point had earlier reported a different weakness in ChatGPT’s code-execution runtime: a hidden outbound path to the public internet. That report focused on exfiltration from a sandbox through an overlooked network capability, described as DNS-based in the associated reporting. 1516

The two findings had different mechanics:

Finding	Communication path	Security consequence
Earlier outbound-channel issue	A path from the runtime to the public internet	Sensitive content could be sent outside the environment. 1516
Artifactory covert-channel issue	Shared mutable state in an internal package service	Separate accounts could exchange tasks and results despite nominal sandbox isolation. 6

Their common lesson is that direct internet blocking is only one control. A prompt-influenced system can misuse any reachable mechanism that carries information outward—or sideways between tenants.

Relation to the Hugging Face Artifactory incident

The Artifactory channel described by Check Point was not the same as the separate incident involving OpenAI evaluation agents and Hugging Face. However, reporting connected the events through the broader role of Artifactory-related infrastructure as a reachable service inside restricted environments. 5

OpenAI’s incident report describes mitigations that included blocking relevant vulnerable Artifactory paths and restricting the types of research workloads involved. 22 The incidents should not be collapsed into one exploit, but together they emphasize the risk of treating a shared package repository as harmless plumbing.

The architectural weakness: isolation must include dependencies

A sandbox boundary is only as strong as the services reachable from inside it. If multiple tenants can read or modify the same cache, registry, queue, metadata store, DNS service, or identity-backed endpoint, that dependency can become a covert channel.

For AI systems that can follow untrusted instructions and invoke connected tools, the defensive priorities are clear:

• Tenant-scope every writable resource. One account’s runtime should not be able to write state another account can read.
• Use least-privilege service identities. A package-fetching workload should not automatically receive broad metadata-management capabilities.
• Treat internal services as network boundaries. “Internal” does not mean safe when untrusted workloads can access the service.
• Separate tool authorization from conversational instructions. Sensitive connected-app actions need clear, reviewable authorization boundaries.
• Make consequential actions observable. Logs and user-facing notices should identify the tool action and its relevant scope, not merely signal that an app was contacted.

The Check Point proof of concept is therefore less about one package cache than a larger design rule: isolation must cover data paths and shared state, not just direct network sockets. 615