Full Report
Research by: Alexey Bukhteyev Key Takeaways Introduction Over the past several years, AI assistants have moved far beyond text generation. Modern systems can execute code, install additional dependencies, analyze user files, and access data through connected services. These capabilities significantly increase the practical value of LLMs, but they also change the security model: protecting user […] The post The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT appeared first on Check Point Research.
Analysis Summary
# Vulnerability: Cross-Account Data Leakage via Shared Internal Service in ChatGPT
## CVE Details
- **CVE ID**: Not explicitly assigned in the report (Research released Sept 2026).
- **CVSS Score**: Estimated 7.5 - 8.2 (High)
- **CWE**: CWE-1189 (Improper Isolation of Shared Resources on Network), CWE-200 (Information Exposure)
## Affected Systems
- **Products**: OpenAI ChatGPT
- **Versions**: Active production environment as of June 2026.
- **Configurations**: ChatGPT sessions with "Code Interpreter" (Advanced Data Analysis) enabled, particularly those with connected third-party apps (e.g., Gmail, Google Drive).
## Vulnerability Description
The vulnerability stems from a breakdown in tenant isolation within the ChatGPT code-execution sandbox. While ChatGPT uses isolated containers to execute Python code, these containers share access to an internal service used for delivering software packages and managing mutable states.
An attacker can establish a covert, bidirectional communication channel between two distinct ChatGPT accounts by exploiting this shared internal infrastructure. By using the shared service as a "clipboard," an attacker can send instructions to a victim's session and receive exfiltrated data back, bypassing the network sandbox that otherwise prevents direct internet access from the execution environment.
## Exploitation
- **Status**: PoC available (demonstrated by Check Point Research).
- **Complexity**: Medium
- **Attack Vector**: Network / Social Engineering (Prompt Injection).
- **Method**: The attack is triggered via a malicious prompt, a shared conversation link, or a custom GPT. Once the victim interacts with the malicious context, the code-execution environment secretly relays data (such as emails or files) to a shared internal resource which the attacker then reads from their own session.
## Impact
- **Confidentiality**: **High**. Attackers can exfiltrate conversation history, uploaded files, and data from connected services (e.g., Gmail).
- **Integrity**: **Medium**. The attacker can execute hidden tasks within the victim's session, potentially modifying data within connected apps.
- **Availability**: **Low**. The primary goal is data theft rather than service disruption.
## Remediation
### Patches
- OpenAI has implemented backend mitigations to ensure tenant isolation within the shared internal services used by the code-execution environments.
- Users do not need to take action for server-side fixes, but should ensure they are using the latest version of the ChatGPT interface.
### Workarounds
- Disable "Connected Apps" if not strictly necessary.
- Avoid interacting with shared chat links or custom GPTs from untrusted sources.
- Monitor ChatGPT's "Advanced Data Analysis" output (if visible) for unexpected Python execution.
## Detection
- **Indicators of Compromise**: Unexpected Python code execution involving network requests to internal package mirrors or unusual state-management commands.
- **Detection methods**: Reviewing the "Work" or "Code" dropdowns in ChatGPT responses to see if the model attempted to access resources or run scripts not requested by the user.
## References
- Check Point Research: [https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/](https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/)
- OpenAI Incident Postmortem (Related): [https://openai.com/index/hugging-face-incident-and-the-road-ahead/](https://openai.com/index/hugging-face-incident-and-the-road-ahead/)