Repository-item properties in one internal Artifactory carried data between two ChatGPT accounts

Each ChatGPT container in the test carried credentials for the same internal JFrog Artifactory instance, already available inside the environment and intended for reader access, according to Bukhteyev ^[4][5]. That reader access also allowed persistent state to be changed ^[5]. One container sets a property on a repository item and a container belonging to a different account observes the change, with no direct link between them ^[6][4].

Bukhteyev told Lets Data Science: "The prompt steered the model into performing the task; the infrastructure provided the unintended cross-account path." ^[8] He described the underlying issue as shared mutable state, meaning information that more than one environment can both change and observe ^[9].

A model may reject an instruction today and accept a differently worded version tomorrow, so the infrastructure still has to enforce which account may read or change a resource even when the model asks for the wrong action, per the LDS account ^[17]. The same account takes on a second assumption, that an operation which appears to stay inside a sandbox is harmless: where a reachable service exposes shared state, a local-looking write can have effects outside that user's environment ^[19]. I would start by auditing authorization on every internal service both tenants can reach.

The demonstration started from a shared conversation with a hidden instruction already in the context, after which the user sent an ordinary message and the session retrieved Gmail data while producing its visible answer ^[11]. What it could reach depended on the tools, data and permissions that session already had, and Check Point presented it as a research demonstration; the account does not claim that arbitrary Gmail accounts could be read or that widespread customer compromise occurred ^[12].

Check Point validated the cross-account proof of concept on June 26, 2026, retried the technique in early July, found the demonstrated channel no longer worked, and disclosed afterwards ^[13][15]. Less than two weeks passed between the working proof of concept and the retry that failed ^[18]. Bukhteyev said OpenAI later confirmed that the internal Artifactory instance identified in the research had been decommissioned ^[14].

Detection is the hard part for an adopting team. The response text in the demonstration was a useful answer to the user's request, while the session also fetched Gmail data and moved it to another account ^[1]. Reviewing only what is shown to the user would miss that, so the LDS account says to examine tool activity alongside the final response ^[16]. Bukhteyev framed the reported problem as the permissions and separation of that one internal service, which does not establish that every Artifactory deployment has the same weakness ^[10].