THE SHARED CLIPBOARD INSIDE THE SANDBOX: CROSS-ACCOUNT DATA LEAKAGE IN CHATGPT

Summary from the TLDR InfoSec newsletter

Check Point Research discovered that ChatGPT code-execution containers from different accounts were using package metadata as a covert cross-account channel because these containers could read and write item properties on the same internal JFrog Artifactory instance. This allowed attackers to deliver a planted instruction through a shared conversation, a custom GPT, or a pasted prompt. The model would then run a hidden second task stream in the same turn, pulling data from the victim's connected Gmail while the visible answer stayed clean. Although OpenAI has decommissioned that Artifactory instance, defenders should enable per-session isolation for any mutable state in shared internal services and review default low-risk reads configuration.