Case · DiggingBeagle record
Check Point demonstrated a covert channel across ChatGPT code-execution environments that could make a victim session use its own connected tools and return results to an attacker account.
Check Point proof of concept disclosed September 8, 2026. The Gmail access described here was a controlled demonstration, not a claim of mass exploitation.
The code-execution containers looked isolated at the obvious boundary: they could not directly talk to each other or reach the public internet. Check Point found a less obvious shared path. Containers belonging to different accounts could all reach the same internal service used for software packages.
The researchers turned that shared service into a command and return channel. A hidden instruction in the victim's conversation could receive a task from an attacker account, use the tools available to the victim session, and send the result back without putting the hidden task into the normal visible answer. In the proof of concept, the victim session read connected Gmail data.
This is useful beyond one product because it shows why sandbox review has to include shared infrastructure and connected authority. A container can be locally isolated while still acting as a bridge into a user's private tools if the surrounding service graph creates a covert path.
A crafted instruction arrives through a prompt, shared conversation or custom GPT.
Boundary: visible conversation / hidden task
Separate code-execution environments exchange command state through a common internal service.
Boundary: isolated containers / shared service
The victim session uses capabilities available to its account, including a connected Gmail tool in the proof of concept.
Boundary: hidden task / connected app
The covert channel carries the result back toward the attacker account.
Boundary: victim account / attacker account
The disclosure describes the shared-service channel and Gmail proof of concept.
The research says the internal Artifactory instance used by the demonstrated path was decommissioned.
Locator: Proof-of-concept section
The proof of concept used the victim's connected Gmail capability and returned retrieved data through the covert channel.
Scope: This closes the reported path, not every possible shared-service channel.
Locator: Disclosure and remediation discussion
The research notes that the internal Artifactory instance used by the demonstrated path was decommissioned.
Locator: Key takeaways and shared-service analysis
Check Point reports that isolated containers could reach the same internal software-package service and use it as a cross-account channel.
Locator: Key takeaways
Check Point lists a malicious prompt, shared conversation and custom GPT as instruction-delivery routes.
diagram
Places task state into covert channel
Reachable from separate code-execution environments
Receives hidden task alongside visible request
Victim-authorized capability used by PoC
Result crosses back through the shared channel
diagram
Check Point's framing for a victim session that executes a hidden attacker task with its own connected authority
Isolation evidence should enumerate shared internal services and connected-account capabilities. The security boundary is not only the container network namespace.
DiggingBeagle. “A shared internal service became a cross-account ChatGPT data channel.” First seen Sep 8, 2026. https://diggingbeagle.com/cases/a-shared-internal-service-became-a-cross-account-chatgpt-data-channel/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.