ChatGPT sandbox flaw leaks Gmail data across accounts
A hidden flaw in ChatGPT's internal code-runner let attackers secretly read and steal data from Gmail and other linked accounts, even when the victim never saw anything wrong in their chat. The issue was in a shared storage system that all ChatGPT's temporary code environments could access, bypassing the supposed account separation.
- Report priority
- High
- Involves
- ChatGPT
What is known
- ChatGPT uses isolated containers to run code or install packages without touching your main system.
- These containers are supposed to stay separate from each other, even if they belong to different users.
- But researchers found that all containers could connect to the same internal storage system, which held shared files and settings.
- Attackers could write a hidden note into that storage from one account and then read it from another account's container.
- Since the storage wasn't locked to a single user, the attacker could secretly copy data, like emails from Gmail, without the victim noticing.
What to do
The issue is fixed now, but if you're unsure whether you were impacted, check if you saw any unusual activity in your Gmail or other linked accounts after using ChatGPT. If you're still concerned, you can review ChatGPT's security updates or contact OpenAI's support for further guidance.
OpenAI has already fixed this issue. If you're a regular user, you can safely continue using ChatGPT as the vulnerability has been resolved. For more details, check OpenAI's official security advisories or their support page.
Reported details
An attacker could start a chat with a victim, then use the shared storage to write a hidden file containing the victim's Gmail login details. Later, the attacker could log in from another account and read that file, stealing the data without the victim seeing any unusual activity in their chat.
ChatGPT's isolated code-execution sandboxes, used for tasks requiring Python or npm package installation, were found to share a hidden communication channel via a JFrog Artifactory instance. Researchers discovered that containers across different accounts could read and write metadata properties in the shared /api/storage/{repoKey}/{itemPath} endpoint, bypassing intended isolation. By exploiting this, an attacker could embed a hidden instruction (e.g., "fetch Gmail emails") in a victim's session, then use the shared storage as a relay: the victim's sandbox would execute the task via connected apps (like Gmail) and write results back to the attacker's container.
The flaw allowed arbitrary data exfiltration, including emails, files, or other sensitive info, without triggering visible alerts in the victim's conversation. No elevated permissions were required; the attack relied on the victim's session being active and connected to the targeted service. Check Point demonstrated the technique by passing timestamps and later, full task results, proving the channel's persistence.