Overview
Check Point Research (CPR) disclosed a critical cross-account data leakage vulnerability in ChatGPT, dubbed the ‘shared clipboard’ attack. Researcher Alexey Bukhteyev demonstrated that a covert communication channel could be established between code-execution containers belonging to entirely separate ChatGPT accounts. An attacker could leverage this channel to execute hidden tasks inside a victim’s active session, silently accessing tools, files, and connected services — including Gmail — without the victim observing anything unusual in their conversation.
The finding is significant because it defeats two assumed security properties of ChatGPT’s sandbox: inter-user container isolation and the absence of outbound internet access from within the execution environment.
Technical Analysis
ChatGPT routes tasks requiring code execution to isolated containers. These containers are explicitly blocked from direct internet access and, in theory, cannot communicate with containers from other accounts. CPR identified a critical exception: all containers, regardless of account ownership, could reach the same internal service responsible for delivering software packages.
This shared internal package delivery service became the covert channel. An attacker could craft a payload — embedded in a malicious prompt, a shared ChatGPT conversation, or a custom GPT — that instructs the model to install a specially constructed package. The package delivery mechanism carries attacker-controlled data into the victim’s container environment. The victim’s session executes the hidden instruction and its output is relayed back across accounts to the attacker.
Critically, the attacker’s task was processed in a separate logical flow, with only a normal-looking answer returned to the victim in the visible chat. The conversation display gave no indication that a secondary, attacker-directed task had occurred.
In the proof-of-concept, CPR demonstrated retrieval of email content from a victim’s connected Gmail account and its exfiltration to the attacker. The same technique could also harvest conversation history and files present in the affected sandbox environment. The blast radius is bounded only by the permissions and connected services already granted to the victim’s session.
Framework Mapping
- AML.T0051 (LLM Prompt Injection) — The attack initiates via a hidden instruction injected into the victim’s conversation context.
- AML.T0057 (LLM Data Leakage) — Email content and conversation history are exfiltrated across account boundaries.
- AML.T0080 (AI Agent Context Poisoning) — The victim’s agentic context is silently poisoned with attacker instructions.
- AML.T0086 (Exfiltration via AI Agent Tool Invocation) — Connected apps (Gmail) are invoked without user awareness to exfiltrate data.
- LLM01 (Prompt Injection) and LLM06 (Sensitive Information Disclosure) are the primary OWASP mappings, with LLM08 (Excessive Agency) applicable given the model’s willingness to act on injected instructions using real user credentials.
Impact Assessment
Any ChatGPT user who has connected third-party services (email, calendars, productivity apps) was potentially exposed. The attack required no victim interaction beyond engaging with a poisoned conversation or custom GPT. Data accessible through connected integrations — potentially including sensitive business communications — was within scope. The severity is compounded by the silent nature of the exfiltration: victims had no mechanism to detect the covert activity.
Mitigation & Recommendations
- Revoke unnecessary app integrations — Remove ChatGPT connections to email and other sensitive services until OpenAI confirms the issue is fully remediated.
- Treat all shared conversations and custom GPTs as untrusted — Apply the same scrutiny as you would to clicking an unknown link.
- Monitor OpenAI’s security disclosures — Track patching status for the internal package delivery service isolation flaw.
- Apply least-privilege principles — Grant ChatGPT integrations only the minimum permissions required for specific tasks.
- Enterprise teams — Review audit logs for connected app activity and consider disabling third-party integrations in high-sensitivity environments.