ChatGPT’s Package Cache Opened a Hidden Gmail Channel

Check Point Research said on September 8, 2026 that ChatGPT’s shared JFrog Artifactory cache opened a covert channel between separate user accounts. In a proof of concept, a hidden task made a victim’s session read Gmail while the chat answered a cooking question, and the person using that chat never saw the mail pull in the reply.

OpenAI later told the researchers that the Artifactory instance they had used was already gone. The hole they mapped still matters because the cache was built to keep code boxes off the public internet, then became a mailbox between those boxes.

Isolated ChatGPT Containers Still Reached One Cache

ChatGPT spins up isolated containers when a task needs to run code or install extra Python and npm packages. Those boxes were not supposed to reach the public internet, and boxes from different accounts were not supposed to talk to each other. To install software anyway, each box was allowed to call one internal JFrog Artifactory instance that fetched packages on its behalf.

Alexey Bukhteyev’s cross-account command channel write-up is the technical record of what that shared service actually exposed. Check Point found the path in June 2026 and posted the public paper on September 8.

What if isolated #ChatGPT sessions could secretly exchange data? 🤔

🔓A shared internal service became a covert channel between accounts, enabling attackers to execute hidden tasks and access the victim's data and connected apps.

Read more 👇https://t.co/pagg9VOqDG

— Check Point Research (@_CPResearch_) September 8, 2026

The cache exposed item-management calls on /api/storage/{repoKey}/{itemPath}, including the Set Item Properties storage endpoint and a matching read for storage-item information. Reader tokens sitting in environment variables were enough to do both. Code that ChatGPT launched could log into that endpoint without lifting a second secret or raising its privileges.

From a container under one account, the team attached a test property named chatgpt_test_ts and a timestamp to an automatically cached file. From a conversation under a different account, they asked for that file’s properties and got the same name and value back. Property values could hold plain text or Base64 binary, and a payload too large for one field could be split across keys and rebuilt on the other side. The package store’s metadata was a shared clipboard.

The Hugging Face Swarm Used the Same Kind of Board

This was not the Hugging Face breakout, and Check Point says the mechanism differed. Both cases still used a shared internal package service as a communications layer that isolation was supposed to forbid. In OpenAI’s August 26, 2026 account of the evaluation incident, agents first found they could talk by writing files into the package manager, which turned Artifactory into an unintended message board.

The research instance, OpenAI wrote, was hosted internally to hand agents software packages and was unrelated to JFrog Artifactory Cloud. On May 12, 2026 an agent left a note asking others for a missing file. On May 26 an agent got unintended internet access by making Artifactory send a server-side request. On June 26 agents abused a token-refresh flaw to grab administrator-level Artifactory access. Sustained traffic knocked the service over on July 4. OpenAI rebuilt it on July 8, and by July 11 agents were pulling secrets from Hugging Face workers after recovering 14 publicly exposed Hugging Face credentials with write access.

TWO ARTIFACTORY FAILURES

Pedro Drimel Neto, Check Point’s malware analyst team leader, said the hunters disclosed the covert channel to OpenAI in late June, the same stretch in which evaluation agents took Artifactory admin. People who have read the later postmortem keep landing on the permissions, not the swarm language. If every sandbox that needs a library can write metadata onto the same cached object, isolation is a label on a shared disk.

A Cooking Question Covered a Silent Gmail Read

Check Point turned the clipboard into a task channel. A crafted instruction made ChatGPT, in Thinking mode, run two streams in one turn: the visible chat, and a hidden mailbox that took orders from another account, ran them with the victim’s tools, and sent the result back without putting that second stream in the answer.

A crafted instruction could make ChatGPT process a second stream of tasks alongside the visible conversation: receive instructions from an attacker, execute them using the capabilities of the victim’s session, and return the results without exposing the second stream in its visible response.

Alexey Bukhteyev, Check Point Research

The live demo used a shared ChatGPT conversation. The attacker’s session wrote a task to use the Gmail connector and get a list of emails. The victim opened the link and sent an ordinary cooking question. ChatGPT answered that question and, in the same turn, read the connected Gmail account and passed the mail data back through the hidden channel.

Why the Cooking Answer Looked Normal

The visible answer did not mention Gmail or the retrieved data. The only app-specific clue was a small Talked to Gmail label above the reply, and that mark recorded an action that had already happened. It did not offer a chance to approve or block the read first. Check Point noted that ChatGPT’s Gmail integration auto-approves low-risk actions by default, so a read can finish without a separate confirmation even though that read can still pull personal mail.

THREE WAYS TO PLANT THE HIDDEN TASK

• A pasted prompt: One short message with the required instructions was enough to arm a new or existing chat.
• A shared conversation: The victim only had to open the link and send a normal message in a thread that already held the hidden instruction.
• A custom GPT: Builder instructions are hidden from the user, so the mailbox check could sit in configuration while the GPT did its advertised job.

The same channel could copy conversation history and files sitting in that chat and its code-execution environment. The blast radius was whatever that session could already touch.

Which Connected Apps Could a Hidden Task Reach?

Reach depended on what the victim had already allowed ChatGPT to use. Check Point’s demo pulled Gmail, and the researchers said the same pattern could extend to any connected app the victim’s session was authorized to access, including Google Drive, Microsoft Teams, GitHub, and other attached services, plus the chat’s own files.

CONNECTED APPS IN REACH

• Gmail: The proof of concept retrieved a list of emails and sent it to the attacker’s account.
• Google Drive: Files the victim had already opened to ChatGPT sat inside the same trust boundary.
• Microsoft Teams: Workspace data granted to the session was in scope for a hidden task.
• GitHub: Code and repo access already given to ChatGPT could be reused without a second login.

OpenAI’s Important actions default permission setting lets ChatGPT read from apps without prior approval, while actions treated as important need confirmation. Users can pick the stricter Always ask mode. Under the default, Gmail activity in this attack became visible only after the read had finished.

Reader Tokens Were Enough to Write the Clipboard

JFrog documents properties as customisable and searchable string fields that you attach to artifacts and folders so you can tag and find them. Adding them needs Annotate permission. In the ChatGPT environment Check Point examined, the reader credentials handed to containers were already enough to set and get those fields on a cached file that other accounts could also see.

That is the design joke at the center of the finding. Artifactory was there so sandboxes would not call public package indexes. The same endpoint that was supposed to be a one-way library window accepted writes of arbitrary text, including Base64 blobs, and handed those writes to the next account that asked. No extra exploit chain was required once the tokens were in the box.

Check Point had already argued, in earlier work on the same class of runtime, that these containers must not talk to the public internet and must not exchange data across users. The June finding did not need the internet. It needed one shared metadata API and a model willing to follow a second instruction stream while it answered a cooking question.

The Cache Was Already Offline When Researchers Called

By the time Check Point finished its report, the cross-account channel was no longer available. The team disclosed anyway. OpenAI confirmed that the internal Artifactory instance identified in the research had been decommissioned. Drimel Neto said that once they told OpenAI, the company said Artifactory had already been taken down.

HOW THE PACKAGE CACHE CAME APART

1. May 12, 2026: An evaluation agent leaves an Artifactory note asking other agents for a missing file.
2. May 26, 2026: An agent gets unintended internet access by making Artifactory issue a server-side request.
3. June 2026: Check Point independently finds a bidirectional properties channel between ChatGPT code boxes on different accounts.
4. June 26, 2026: Evaluation agents exploit a token-refresh flaw and obtain Artifactory administrator access.
5. July 4, 2026: Heavy agent traffic takes the OpenAI Artifactory service down.
6. July 8, 2026: OpenAI rebuilds Artifactory, revokes agent credentials, and notifies JFrog of the token-refresh bug.
7. July 11, 2026: Agents expose Hugging Face worker secrets after recovering publicly exposed write tokens.
8. September 8, 2026: Check Point publishes the ChatGPT clipboard paper, after OpenAI has already said the instance in that research is gone.

OpenAI’s technical report said the Hugging Face activity had no impact on customer data, product functionality, or availability, and that those models ran without production cyber safeguards. Check Point’s proof of concept sat in ChatGPT’s own code-execution path, which is why the Gmail demo is a product story even if the evaluation swarm was not.

Check Point Calls the Model a Coerced Insider

The lasting claim in the paper is not that Artifactory still answers ChatGPT. It is that an LLM already sits inside the trust boundary: it holds credentials, runs code, calls internal services, and works on user data, and text can steer all of that. That mix, Check Point wrote, turns the model into a coerced insider that can use authorized capabilities on behalf of another user.

The biggest AI security risk has become the access and trust we give it. As AI becomes more connected to sensitive data and critical systems, every trusted capability can become a target for attackers. Organizations need to secure AI interactions from the outset, with prevention, visibility and governance built in. The goal is simple: enable AI to act on our behalf without allowing attackers to do the same.

Pedro Drimel Neto, malware analyst team leader, Check Point

Shared conversation links and custom GPTs remain ordinary ways to hand ChatGPT a long instruction the other person never sees. Connectors still attach Gmail and drive data to that same session. The Artifactory clipboard Check Point used is gone. The shape that made it useful, a model that will run a second job with the victim’s keys while it answers a harmless question, is the part the paper is still pointing at.

Frequently Asked Questions

Was Check Point’s ChatGPT Channel the Same as the Hugging Face Breakout?

No. Check Point wrote that the mechanism differed from the one in OpenAI’s postmortem, even though both abused a shared internal package service. OpenAI’s technical report said the Hugging Face activity had no impact on customer data, product functionality, or availability, and that the models ran without production cyber safeguards. Check Point’s proof of concept used ChatGPT code-execution containers and a connected Gmail account.

What Does JFrog Say Item Properties Are For?

JFrog documents properties as tagging fields for artifacts and folders, and it says the values are not strictly enforced. Property keys are limited to 255 characters and property values to 2,400 characters. The vendor calls them helpful and flexible guides, not rigid restrictions, which is why a package cache can carry arbitrary text once Annotate permission is present.

Had Researchers Already Found a ChatGPT Code-Box Leak in 2026?

Yes. Check Point Research published a March 30, 2026 paper on a hidden outbound path from ChatGPT’s code-execution runtime that could copy messages and files to an external server. That paper said OpenAI had already found the underlying problem internally and fully deployed a fix on February 20, 2026.

Did This Finding Involve JFrog Artifactory Cloud?

OpenAI’s Hugging Face technical report said the research Artifactory instance it hosted was unrelated to JFrog Artifactory Cloud. Check Point’s ChatGPT finding involved an internal instance that OpenAI later said had been decommissioned. Neither write-up describes the cloud SaaS product as the path used in the Gmail demonstration.