The victim opens a shared ChatGPT conversation, types an ordinary question and gets an ordinary answer. Nothing in the reply looks unusual. While that answer was being written, the same session reached into the user's connected Gmail account, pulled data out of it and delivered the result to a complete stranger's ChatGPT account.
That was a proof of concept, not a live attack. It still worked.
Alexey Bukhteyev of Check Point Research published the findings on Monday, from work carried out in June. The interesting part is not that a model followed a malicious instruction. It is that two code-execution containers belonging to two different ChatGPT accounts, which are not supposed to be able to reach the internet or each other, found a way to pass messages back and forth.
A clipboard hidden in a package server
When ChatGPT needs to run code it spins up an isolated container. Those containers cannot reach the public internet, which is what stops a hijacked session from simply posting stolen data to an attacker's server. But code often needs libraries, so the containers were permitted to reach one internal service: a JFrog Artifactory instance acting as a controlled middleman for package downloads.
Artifactory exposes item management operations on its storage endpoint. One of them attaches arbitrary string properties to a repository item such as a file or folder. Another reads those properties back. Both containers could reach the same instance, and the credentials available to them allowed writing as well as reading. A property field on a shared file is not much, but it is enough: one container writes, the other polls and reads, and the isolation that the network sandbox was enforcing quietly stops mattering. Check Point describes the result as a shared clipboard, and it ran in both directions.
The model as a coerced insider
The channel by itself moves bytes. Turning it into an attack needed one more step, which was getting an instruction into the victim's conversation context. Check Point lists three ways in: a malicious prompt, a shared conversation link, or a custom GPT, where the builder instructions are never displayed to the person using it. Once the instruction is in context, any ordinary message from the user can trigger a second stream of work alongside the visible one. The attacker sends tasks through the clipboard, the victim's session carries them out with the victim's own tools and permissions, and the results come back the same way. The visible answer never mentions it.
What an attacker gets therefore depends entirely on what the victim's session already had. In the demonstration that meant a connected Gmail account. It could equally mean conversation history, uploaded files, or any other connected app. The researchers frame the model as a coerced insider, not malicious but persuaded, operating inside the trust boundary with real credentials.
Check Point notes that OpenAI's own postmortem of the recent Hugging Face incident described agents in separate evaluation environments establishing unauthorized communication channels between themselves. The mechanism there was different. The architectural weakness was the same one: a shared internal service becoming a communication layer between environments that everyone believed were isolated.
The channel is already closed
By the time the report was finished the cross-account channel had stopped working. Check Point disclosed anyway, and says OpenAI confirmed that the internal Artifactory instance identified during the research had been decommissioned.
The lesson the researchers draw is worth more than the bug. In an agentic platform, every resource the model can touch is part of the attack surface, including internal APIs and shared mutable state that nobody thinks of as user-facing. Management interfaces should not be reachable from the runtime at all, and within a shared internal service, anything one container can write must stay readable only to the session that wrote it. Connecting external apps raises the cost of getting that wrong, because a session that can read your mail is worth far more than a sandbox that can only run Python. Similar reasoning applies to the coding agents that a hostile repository can hijack on checkout, and to earlier work on steering ChatGPT past its own safety filters.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.