Redbot Labs / Threat Intelligence
Researchers Demonstrate ChatGPT Cross-Account Data Leakage Through Shared Internal Infrastructure
- Incident ID
- RBT-TI-0092
- Organization
- OpenAI
- Reported Location
- San Francisco, California, United States - Organization Location; Infrastructure Location Undisclosed
- Severity
- High
- Category
- Prompt Injection / Cross-Account Data Leakage / Tenant Isolation Failure
- Record Date
- 2026-09-08
Incident Summary
Check Point Research demonstrated a communication channel between ChatGPT sessions belonging to separate accounts through a shared internal Artifactory service.
The researchers showed how manipulated instructions could use this channel to transfer information across account boundaries. OpenAI confirmed that the relevant Artifactory instance had been decommissioned. Check Point technical report
What Happened
Shared service access
Otherwise isolated code-execution containers could reach the same internal package service. Their credentials permitted reading and modifying repository-item properties.
Cross-account communication
Researchers wrote a property from one account and retrieved it from another, demonstrating shared mutable storage without account isolation.
Connected-app demonstration
Check Point’s accompanying report describes using a manipulated session to retrieve connected Gmail information and relay it to another account.
Remediation
The demonstrated channel was unavailable by publication. The reports describe a proof of concept, not an established campaign against customers. Technical findings · Connected-app demonstration
Affected Systems
ChatGPT Code-Execution Environments / Shared Artifactory Metadata / Connected Gmail Data in Research Demonstration
Attack Vector
Manipulated Agent Instructions / Excessive Service Permissions / Cross-Account Shared Storage
Business Impact
Demonstrated confidentiality risk
The research showed that account isolation could fail through an internal service even when containers could not communicate directly.
Potential enterprise consequences
An equivalent weakness in an enterprise assistant could expose information available through connected business accounts. Potential consequences depend on connector permissions and accessible data.
Known limits
The cited reports do not establish a victim count, criminal exploitation, or financial losses. The specific demonstrated channel was closed. Check Point report
Redbot Analysis
Test every shared resource across account boundaries
Redbot Labs assesses that isolation testing should cover more than direct network connections between workloads. Shared caches, package services, metadata stores, logging systems, and temporary storage can create indirect routes between users.
A useful validation test asks whether information written under one account can be retrieved or altered under another, including through services considered supporting infrastructure.
Restrict permissions to the required task
A service used to retrieve dependencies should grant only the permissions needed for that purpose. Administrative and metadata-writing capabilities should be separately justified and restricted.
Testing should inspect effective permissions rather than rely on account names or labels such as “reader.”
Assess connected apps as part of the same attack surface
An assistant’s potential exposure includes the information it can retrieve through integrations. Email, document storage, and repository access should be evaluated alongside the assistant’s execution environment.
Security reviews should consider whether an instruction from an untrusted source can cause the assistant to retrieve sensitive information and move it somewhere the legitimate user did not intend.
Keep authorization independent of model judgment
A model’s interpretation of a request should not determine whether one account can access another account’s data. Account boundaries require controls enforced by the underlying services.
Input filtering and model safeguards can complement these controls, but they should not carry the full responsibility for tenant isolation.
Validate the complete data path
Redbot testing should trace information from its original source through retrieval, processing, temporary storage, and output. This helps identify exposure paths that would be missed by testing the model, connector, and infrastructure separately.
Sources
Check Point — ChatGPT Let Attackers Read Victims’ Gmail Through a Hidden Channel Between Accounts
