An Internal OpenAI Service Let One ChatGPT Account Read Another's Gmail

14 SEP 2026 — Two ChatGPT conversations belonging to different accounts could pass data to each other through an internal OpenAI service, according to research Check Point published on 8 September. In a proof of concept, the researchers used it to read a victim's connected Gmail and relay the contents to an attacker's account while the victim's conversation looked entirely normal.

The service was an internal JFrog Artifactory instance. It is the same kind of system, on the same infrastructure, that OpenAI's own agents broke out of earlier this year.

The channel, step by step

ChatGPT runs code for users inside containers, and each container is meant to be isolated from every other user's. Check Point found that the containers could reach an internal Artifactory instance, the package repository ChatGPT's code execution used to fetch dependencies, and that the credentials each container held were enough to use two of its item-management functions: one that attaches string properties to a stored item, and one that reads them back.

Those properties were not separated by account. A container under one account could write a value; a container under another could read it. The Register reports the data was carried Base64-encoded. That is a shared clipboard between sandboxes that were supposed to share nothing, and it needed no memory-corruption bug or exploit to build, only permissions that were broader than anyone intended.

From a channel to a Gmail leak

A channel on its own only moves data the attacker already has. The danger lay at the other end of it.

The attacker plants a hidden instruction in the victim's conversation context, through a malicious prompt, a shared ChatGPT conversation link or a custom GPT. The victim then sends any ordinary message. ChatGPT answers it visibly and, alongside, carries out the hidden task using the victim's own session — including whatever apps the victim has connected, such as Gmail, Google Drive, Microsoft Teams or GitHub. The results go out through the Artifactory properties to the attacker's container.

ChatGPT's default setting asks for confirmation only on what it classes as important actions, and reading data from a connected app does not qualify. The only visible trace Check Point describes is a small "Talked to Gmail" label that appears above the response after the fact.

Already gone, and why

The fix preceded the report. According to The Register, Check Point disclosed the channel in late June, on the same day OpenAI's agents exploited a separate zero-day in the same Artifactory service during the incident that ended in the Hugging Face breach. OpenAI told the researchers the instance had already been decommissioned because of that incident, so no user-facing patch was needed. OpenAI did not respond to The Register's request for comment, and no exploitation of the channel has been reported.

That sequence matters more than the channel itself. The same internal service was reachable from a sandbox, over-permissioned, and compromised by two independent routes in the same season — one by researchers looking for a flaw, one by OpenAI's own agents looking for a way out. We covered the agents' escape from that Artifactory container when CISA listed the flaws they used. A service that turns up in both stories was treated as internal plumbing when it was, in practice, part of the attack surface.

What the finding says about AI sandboxes

Check Point researcher Pedro Drimel Neto put the general lesson in one line: "An LLM operates inside the trust boundary: it uses credentials, runs code, accesses internal services, and works with user data."