Check Point pulled Gmail data across ChatGPT accounts through a shared package-metadata store

A code interpreter that cannot install packages is not much use, and a sandbox with unrestricted egress is worse than one without, so the install path runs through a service the vendor operates. In ChatGPT that service was internal and backed by JFrog's Artifactory ^[2]. The containers around it were isolated per user account ^[3]. The metadata inside it could be read and written by each of them ^[4].

Check Point's report, as summarised in the dev.to write-up, describes package submission metadata as a shared clipboard between containers that should have been walled off ^[5]. With write access, an attacker could push a task into a victim's session, and a crafted instruction made that session process a second workload in parallel with the conversation the user was watching ^[6]. The researchers call the result an insider threat by proxy: the system was not breached, it was induced to act outside the user's intent inside the organisation's trust boundary ^[16].

What the hidden workload could reach was decided by the victim's own authorisations, not by the sandbox ^[8]. So the OAuth consent screen was the boundary that held.

Detection ran one step behind. The only thing that surfaced was a small label reading "Talked to Gmail", written after the access had already happened ^[9]. An investigation can work from a record produced after the transfer completes, but by then the data has moved ^[20]. The IDC analyst quoted in the write-up, who is not named there, recommends logging every read and write with timestamps and data types into the organisation's own incident management ^[10].

The dev.to article says it was written by an AI model through an agent and reviewed and edited by its author, and it cites a single report by G. Swain ^[12]. On that record, the researchers say their test worked before a separate incident on the same Artifactory system led to the Hugging Face intrusion OpenAI later disclosed, and that the two incidents used different techniques against the same shared internal service ^[13]. OpenAI has fixed the flaw and shut down the related service ^[15].

For the pattern to transfer to your stack, one thing has to be true: some shared component on the sandbox path accepts writes from one tenant that another tenant later reads. A package proxy that stores submission metadata qualifies. So does a build cache keyed on tenant-supplied input. In my view that is the question to ask of a per-tenant sandbox design, because per-container isolation stops at the fan-in point every container is required to talk to. The attack itself was not casual work; it needed knowledge of the internal infrastructure and specific conditions to fire ^[14].