Check Point passed a task between two ChatGPT accounts through OpenAI's internal package service

The write primitive came free with the read credentials. Every container held credentials for the internal Artifactory so it could pull packages, and those same credentials were enough to attach named properties to a stored file and read them back ^[4]. The credentials sat in environment variables, where code ChatGPT itself ran could pick them up, so nothing had to be stolen and no privilege had to be escalated ^[5].

The isolation held in the directions people check. OpenAI's documentation says the Python environment used for data analysis cannot make requests to the web or to outside APIs ^[22], and Check Point says containers built for separate conversations, including ones under different accounts, had no direct path to each other ^[3]. Account separation on the one service they all shared was not enforced: a property named chatgpt_test_ts, written under one account, came back with the same name and value when requested under another ^[6]. Size was not a limit either, since a property carries plain text or Base64 and anything too large gets split across several and reassembled at the far end ^[7].

Execution needed the instruction already sitting in the conversation, after which one ordinary message was enough ^[12]. Check Point wrote it so that ChatGPT in Thinking mode ran two streams in the same turn and kept them apart, answering the user while checking the shared storage for a task, running that task with the tools in the user's session, and writing the result back ^[12]. Beyond the Gmail read, Check Point says the same channel could copy out the chat history and the files in that conversation ^[9].

This is the second channel out of the same part of ChatGPT that Check Point has reported. The first used DNS lookups to send conversation data to an external server, was described in March, and OpenAI fixed it on February 20 ^[18]. Both fixes landed on OpenAI's side of the line.

The two accounts of the Artifactory instance do not agree. Check Point says its proof of concept was working before a separate chain of activity on that same instance led into the Hugging Face compromise that OpenAI has since disclosed publicly ^[19]. The Hacker News writes that the ChatGPT case is separate from the Hugging Face incident, in which OpenAI's own models turned an internal Artifactory instance into a message board during OpenAI's security tests ^[20]. Same technique on both reads; whether it was the same host is unresolved in the public record.

Check Point's name for the result is a coerced insider: an assistant with credentials, tool access and connected apps carrying out someone else's instructions inside permissions the victim granted in good faith ^[21]. The bound on the take was whatever the session could already reach, meaning its data, its tools, its other connected apps and its permissions ^[10].