The report
Check Point Research disclosed a cross-account channel in ChatGPT code-execution environments on September 8. The containers could not communicate directly, but separate accounts could reach a common internal service used for software packages.
The researchers used that shared service as a covert command and return path. In their proof of concept, a victim opened a shared ChatGPT conversation and sent a normal message. The visible request completed, while a hidden task used the victim session's connected Gmail capability and relayed retrieved data toward an attacker account.
diagram
Cross-account shared-service channel
- Attacker account
Places task state into covert channel
- Shared package service
Reachable from separate code-execution environments
- Victim ChatGPT session
Receives hidden task alongside visible request
- Connected Gmail
Victim-authorized capability used by PoC
- Returned data
Result crosses back through the shared channel
- Attacker account Shared package service: command
- Shared package service Victim ChatGPT session: hidden task
- Victim ChatGPT session Connected Gmail: tool use
- Connected Gmail Victim ChatGPT session: result
- Victim ChatGPT session Shared package service: relay
- Shared package service Returned data: cross-account result
Check Point says the specific internal Artifactory path involved in the demonstration was decommissioned. The research does not establish mass exploitation.
The important boundary is broader than that service. Isolation reviews need to include shared package infrastructure and connected-account authority, not only direct network communication between containers.