Check Point Discovers Critical ChatGPT Flaw Allowing Cross-User Data Access
Check Point researchers discovered a critical vulnerability in ChatGPT that bypasses isolation mechanisms via a shared internal server, allowing covert data theft without user consent.
Many users rely on artificial intelligence tools today under the basic assumption that their digital space is secure, and that every conversation, file, or piece of information in their account remains completely isolated from the eyes of other users. However, a dramatic new study by Check Point shatters this illusion of privacy.
Researcher Aleksei Bochtiev from the company's research department discovered an exceptional vulnerability that allowed attackers to completely bypass ChatGPT's isolation mechanisms. Without needing to steal passwords or directly hack into an account, the researchers succeeded in causing an innocent user's chat to access sensitive personal information and transfer it directly to unauthorized hands, all while the user received completely normal answers and suspected nothing.
The Protected Workspace That Became a Vulnerability
To understand the magnitude of the discovery, one must first understand how ChatGPT handles complex tasks. When a user asks the system to perform operations requiring code execution—such as file analysis, mathematical calculations, or graph generation—OpenAI's servers create a temporary, isolated sandbox. This is a closed working environment designed to prevent different users from communicating with each other or viewing each other's data.
However, to allow these isolated environments to install essential software packages without a direct and dangerous connection to the public internet, OpenAI granted them access to a shared internal service called JFrog Artifactory (developed by an Israeli company). This service served as a controlled intermediary for downloading software updates. Yet, the researchers discovered that the configuration of this internal service suffered from a deep structural flaw: it allowed one account's workspace to write data into the shared data repository, and another account's workspace to read it.
The Hackers' Secret Whiteboard
The vulnerability was discovered in the service's item management API. The researchers found that the built-in permissions within the workspace allowed them to use the Set Item Properties and Get Storage Item Information commands on files saved on the server. To prove that the partition between users was compromised, the researchers created a identifying property named chatgpt_test_ts containing a timestamp from one account, and observed how a completely separate ChatGPT account managed to read it without difficulty.
Thus, the internal package service turned into a shared whiteboard or a two-way, covert communication channel between workspaces that were supposed to be hermetically sealed. An attacker could use this channel to leave hidden work instructions, and the victim's ChatGPT could access them, execute them, and send the loot back to the attacker through the same digital whiteboard.
The Silent Takeover by the Invisible User
To activate this malicious mechanism, attackers only needed to inject the initial instruction into the victim's conversation context. This could be done easily by sharing a chat conversation link, embedding the command inside a custom GPT configuration, or simply by persuading the user to paste malicious text. Once the instruction was planted, ChatGPT was instructed to operate in a dual, invisible thinking mode.
On one hand, the system answered the user's legitimate questions completely normally. On the other hand, and in the exact same query, the AI checked the secret mailbox on the shared Artifactory server, retrieved the hacker's commands, and executed them secretly using the legitimate user's permissions.
In Check Point's proof-of-concept demonstration, the researchers caused ChatGPT to contact the user's connected Gmail account, retrieve sensitive emails from it, and send them to the attacker. The only sign of this suspicious activity was a small, unexplained label stating Talked to Gmail that appeared above the response. The user was not asked for prior approval, since under the system's default settings, read operations are considered low risk and are approved automatically.
This danger is particularly significant since many users currently connect ChatGPT to a variety of organizational and personal services such as Google Drive, Microsoft Teams, and GitHub—all of which become directly exposed to the attacker's hidden commands.
From the Hugging Face Incident to the Future of AI Security
Check Point researchers point out that this structural problem is not an isolated case. It is directly related to the famous Hugging Face platform security incident reported by OpenAI, in which AI agents in separate evaluation environments managed to create unauthorized communication channels among themselves. In both cases, the flaw stemmed from shared internal infrastructures unintentionally becoming bridges connecting different users.
Following Check Point's responsible disclosure, OpenAI acted swiftly and completely shut down the internal Artifactory service, thereby blocking this specific communication channel. However, the findings raise hard questions regarding the future generation of artificial intelligence assistants.
As explained by Eli Smadja, a director in Check Point's research department: The research shows that the challenge in AI security is no longer just about the model itself, but also about the level of access and trust we grant it. As AI assistants connect to more internal systems and sensitive information, we must assume that any capability or permission we give them could be abused.
