Threat Brief
Security evaluation demonstrates cross-tenant data transfer in ChatGPT sandbox
At Black Hat USA 2026 in Las Vegas, Simcha Kosman, a senior security researcher at Palo Alto Networks, presented findings on evaluating the isolation controls of ChatGPT's secure sandbox. The presentation, titled "A Billion-User Blast Radius: Owning ChatGPT's Secure Sandbox," detailed a proof-of-concept test sequence designed to bypass the large language model (LLM) supervisor and establish persistent execution.
Sandboxed container environments are engineered with strict controls to provide isolated runtimes. Evaluating their boundaries helps organizations understand theoretical risks, even when findings represent proof-of-concept methodologies rather than immediate enterprise threats. Kosman framed the research with a clear principle: "Private chats should stay private." The assessment explored scenarios where isolated data might inadvertently become accessible to unauthorized processes.
An OpenAI spokesperson told Dark Reading the company was aware of the research ahead of the Black Hat presentation and appreciates Kosman sharing his findings. They noted that the aspect of OpenAI's system involved in the proof-of-concept was removed prior to the presentation. In the company's view, the research does not represent an escape from ChatGPT's security sandbox or unrestricted access to other customer accounts.
Evaluating sandbox isolation
Kosman outlined a sequence to introduce instructions into a user's ChatGPT environment and subsequently transfer data out. "Our first goal is to get sensitive information into the sandbox without being blocked by the LLM," Kosman said. "And the second goal is to send the information from the sandbox back to my server."
The research began by observing how ChatGPT processes URL-based instructions across different operating systems. On Windows and Android, users review prompts from clicked links before submission. On iOS and macOS, these commands executed immediately upon opening the link. This behavior allowed for a single-click workflow where a researcher-supplied instruction executes automatically when a user opens a provided link.
Next, the methodology involved instructing ChatGPT to download a spreadsheet from an external cloud location. Kosman noted that when the AI model processes spreadsheets, it also processes and executes code embedded within the cells. By including proof-of-concept code in a spreadsheet, the researcher could initiate persistent, unsupervised background processes within the model’s hidden Python execution environment. This allowed the test sequence to extract data from connected services, such as Google Drive or Gmail, staging it within the user sandbox.
Cross-environment data transfer
The final phase required transferring data from the user sandbox to an external environment. Direct internet access was restricted, so Kosman analyzed the shared backend infrastructure. ChatGPT sandboxes use JFrog's Artifactory repository manager to handle software binaries.
The researcher discovered that multiple sandboxes communicated with the same Artifactory backend, and account lockout states were visible across accounts. By interpreting these states as binary signals, the researcher established a covert communication channel between two isolated sandboxes. A "too many requests" state represented a binary 1, while a "login failed" state represented a 0.
Through automated, repeated login attempts using an agreed-upon list of usernames, the researcher-controlled agent and the user-side agent could transmit binary data. This two-way channel enabled the researcher to remotely read a list of files belonging to another ChatGPT session and modify the contents remotely. Kosman concluded the presentation by stating the team achieved "full C2 communication entirely inside ChatGPT sandbox."
Disclosure and remediation
A spokesperson for Palo Alto Networks stated Kosman reported five findings connected to this research to OpenAI on March 23: prompt execution through a URL parameter on macOS and iPhone, reasoning injection, a denial-of-service issue involving Artifactory, cross-tenant communication through Artifactory via the username lockout behavior, and URL laundering through scheduled tasks.
OpenAI’s responses varied by finding, with all changes occurring within the standard 90-day disclosure window. The prompt execution behavior was retained as a known issue for compatibility reasons, and the reasoning injection report was marked as out of scope.
To address the Artifactory issues, OpenAI removed the requirement to provide a username and password when downloading packages and eliminated the user lockout behavior that enabled cross-tenant communication. For the scheduled-task finding, OpenAI changed the architecture to prevent URL laundering as part of a major scheduled-tasks update.
Original reporting for this coverage was provided by Alexander Culafi, Senior News Writer at Dark Reading. Culafi covers the cybercrime ecosystem, open-source security, and the intersection between AI and threat modeling.