A threat research team finds that shared package metadata could relay Gmail results through isolated containers without prior confirmation
Security researchers have disclosed a vulnerability in ChatGPT’s code-execution environment that could have enabled data to move between otherwise separate user accounts.
The issue involved an internal package-management service accessible from ChatGPT’s sandbox containers, creating a covert path that researchers said could be used to extract information from connected services, including Gmail. OpenAI has since retired the affected internal service, and has said that users do not need to take action.
ChatGPT creates isolated containers to handle tasks that require code execution. Those environments are designed to prevent direct communications with the public internet and with containers associated with other users. However, researchers note that the containers shared access to an internal JFrog Artifactory deployment used to retrieve Python and npm packages. The service’s Item Management API had allowed a container to add metadata properties to cached package files and later retrieve those properties. Also:
- Researchers found that credentials intended to provide read-only access also allowed containers to write file metadata.
- More importantly, the metadata was not partitioned by ChatGPT account. In testing, the researchers wrote a property to a cached item from a container running under one account and successfully read the same property from a separate account. That had effectively transformed the package repository’s metadata layer into a shared data store capable of bridging environments that were supposed to remain isolated.
- The weakness could be extended beyond passing small messages between accounts. A malicious instruction embedded in a prompt, a shared ChatGPT conversation, or the concealed instructions of a custom GPT could prepare a victim session to receive commands through the covert channel. When the victim would submit a normal request later, the system could provide a visible response while also querying the shared metadata store for a task supplied by the attacker, carrying it out with the victim’s enabled tools and connected applications, then placing the result in the shared channel for retrieval.
The researchers’ proof-of-concept show that the system had accessed data from a victim’s connected Gmail account and sent the results back to an attacker-controlled session. The victim may only have seen a “Talked to Gmail” indicator above the resulting ChatGPT answer, reflecting that the access had already occurred rather than asking for approval in advance. Under ChatGPT’s default “Important actions” permission configuration, read-only actions involving connected apps can occur without an explicit confirmation prompt.
The incident was reported by researchers from Check Point, and points to a recurring isolation challenge: infrastructure shared for operational convenience can become a communications bridge between environments intended to be separated.
