The code-execution containers looked isolated at the obvious boundary: they could not directly talk to each other or reach the public internet. Check Point found a less obvious shared path. Containers belonging to different accounts could all reach the same internal service used for software packages. The researchers turned that shared service into a…
Inspect the ClaimsCase · DiggingBeagle record
A shared internal service became a cross-account ChatGPT data channel
Check Point demonstrated a covert channel across ChatGPT code-execution environments that could make a victim session use its own connected tools and return results to an attacker account.
Scope
Check Point proof of concept disclosed September 8, 2026. The Gmail access described here was a controlled demonstration, not a claim of mass exploitation.
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
Check Point describes a controlled cross-account Gmail demonstration through shared infrastructure, not mass exploitation. Decommissioning of the particular Artifactory instance is reported in the disclosure; broader channel elimination is not verified. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-GMAIL · CLM-CLOSED · CLM-CHANNEL · CLM-DELIVERY · The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT
At a glance
Isolation evidence should enumerate shared internal services and connected-account capabilities. The security boundary is not only the container network namespace.
Read the implicationsThe public source does not establish exploitation of this path against users outside the research proof of concept. The disclosed remediation does not prove that every possible shared-service channel has been eliminated.
Limits and uncertaintyFull account
The code-execution containers looked isolated at the obvious boundary: they could not directly talk to each other or reach the public internet. Check Point found a less obvious shared path. Containers belonging to different accounts could all reach the same internal service used for software packages.
The researchers turned that shared service into a command and return channel. A hidden instruction in the victim's conversation could receive a task from an attacker account, use the tools available to the victim session, and send the result back without putting the hidden task into the normal visible answer. In the proof of concept, the victim session read connected Gmail data.
This is useful beyond one product because it shows why sandbox review has to include shared infrastructure and connected authority. A container can be locally isolated while still acting as a bridge into a user's private tools if the surrounding service graph creates a covert path.
Mechanism and trust boundary
- 01
Deliver a hidden second task
A crafted instruction arrives through a prompt, shared conversation or custom GPT.
Boundary: visible conversation / hidden task
- 02
Use the shared package service
Separate code-execution environments exchange command state through a common internal service.
Boundary: isolated containers / shared service
- 03
Exercise victim authority
The victim session uses capabilities available to its account, including a connected Gmail tool in the proof of concept.
Boundary: hidden task / connected app
- 04
Return results across accounts
The covert channel carries the result back toward the attacker account.
Boundary: victim account / attacker account
Timeline
- Sep 8, 2026Event type unspecified
Check Point publishes the cross-account channel research
The disclosure describes the shared-service channel and Gmail proof of concept.
- Sep 8, 2026mitigation
Specific internal service path reported closed
The research says the internal Artifactory instance used by the demonstrated path was decommissioned.
Claims & evidence
CLM-GMAILIn Check Point's proof of concept, a victim ChatGPT session with connected Gmail retrieved email data and relayed it to an attacker account while still producing a normal visible answer.supported
Basis: reported finding · active
- supportsThe Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPTprimary
Proof-of-concept section
CLM-CLOSEDCheck Point says the internal Artifactory instance involved in the specific path was decommissioned during the disclosure process.supported
Basis: reported finding · active
Scope: This closes the reported path, not every possible shared-service channel.
- supportsThe Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPTprimary
Disclosure and remediation discussion
CLM-CHANNELCheck Point reports a covert cross-account channel between ChatGPT code-execution environments through a shared internal package-delivery service.supported
Basis: reported finding · active
- supportsThe Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPTprimary
Key takeaways and shared-service analysis
CLM-DELIVERYThe hidden task could be delivered through a malicious prompt, a shared ChatGPT conversation or a custom GPT, according to Check Point.supported
Basis: reported finding · active
- supportsThe Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPTprimary
Key takeaways
Evidence visuals
diagram
Cross-account shared-service channel
- Attacker account
Places task state into covert channel
- Shared package service
Reachable from separate code-execution environments
- Victim ChatGPT session
Receives hidden task alongside visible request
- Connected Gmail
Victim-authorized capability used by PoC
- Returned data
Result crosses back through the shared channel
- Attacker account Shared package service: command
- Shared package service Victim ChatGPT session: hidden task
- Victim ChatGPT session Connected Gmail: tool use
- Connected Gmail Victim ChatGPT session: result
- Victim ChatGPT session Shared package service: relay
- Shared package service Returned data: cross-account result
diagram
A sandbox can still behave like a coerced insider
- Coerced insider
Check Point's framing for a victim session that executes a hidden attacker task with its own connected authority
Implications
Isolation evidence should enumerate shared internal services and connected-account capabilities. The security boundary is not only the container network namespace.
Controls and mitigations
- Inventory services shared across nominally isolated execution environments.
- Bind connected-app actions to visible user intent and independently authorized task context.
- Monitor cross-account identifiers and metadata flows through internal package or cache infrastructure.
Unknowns and contradictions
- The public source does not establish exploitation of this path against users outside the research proof of concept.
- The disclosed remediation does not prove that every possible shared-service channel has been eliminated.
Sources and citation
Material revision history
- Sep 16, 2026 · Published version · first publication · revision 2
- Sep 25, 2026 · Published version · material revision · revision 37Public fields changed: assessment_profile
- Oct 8, 2026 · Published version · material revision · revision 99Public fields changed: claims