The Extended Brief

The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT

Brief by The AI News AI newsroom · Sep 8, 2026, 10:20 AM EDT edition

Original reporting by Check Point Research — stcpresearch · published Sep 8, 2026, 9:00 AM EDT

A hidden instruction planted in a shared ChatGPT conversation or custom GPT could silently run attacker tasks in your session and leak data from connected apps like Gmail.

Key points

• Check Point Research says it found a covert cross-account channel that runs hidden attacker tasks inside a victim's ChatGPT session. source ↗
• In its proof of concept, ChatGPT pulled email from the victim's connected Gmail account and relayed it to the attacker. source ↗
• Code-execution containers from different accounts could not reach the public internet but all shared one internal package-delivery service. source ↗
• The hidden instruction could arrive via a malicious prompt, a shared conversation, or a custom GPT, triggered by an ordinary message. source ↗
• The channel could also exfiltrate conversation history and files, with scope set by the victim session's existing tools and permissions. source ↗

Practical applications

• Audit which connected apps and permissions are enabled on ChatGPT sessions that touch sensitive data, and disconnect connectors the workflow does not need.
• Treat shared ChatGPT conversations and third-party custom GPTs as untrusted input in your threat model, since either can carry a hidden instruction.
• If you build sandboxed code execution, test whether isolated containers can still reach shared internal services such as package repositories, and segment them.

Context

ChatGPT can execute code in sandboxed containers and reach user data through connected services such as Gmail, so the model operates inside the security boundary. Check Point Research says these per-account sandboxes, though cut off from the public internet, could all reach the same internal package-delivery service, creating a covert path between accounts. A planted instruction in the victim's conversation context could then trigger attacker-controlled work without appearing in the visible reply.

What to watch

• An OpenAI advisory or change isolating the shared package service between accounts would confirm remediation.
• Independent reproduction or a formal vulnerability disclosure would escalate the story.

Related briefs

• The EU AI Act just gave you a breach notification clock you didn’t know about
• Stealing AI Reasoning Traces
• Discovery of a new OpenAI agent message board
• OpenAI Says New Model Meets Its ‘Critical’ Cybersecurity Threshold

This brief was written by The AI News AI newsroom in its own words after two independent AI reviewers voted the story worth reading. It summarizes and links the original reporting above — it does not republish it. See the methodology or the corrections ledger.