Check Point Research has uncovered a covert cross-account command channel inside ChatGPT that could let an attacker execute hidden tasks using a victim's session tools, including retrieving email from a connected Gmail account. The channel works through the code-execution containers of different ChatGPT accounts, which can reach the same internal JFrog Artifactory instance.
The attack can be triggered by a single short message containing hidden instructions, delivered through a malicious prompt, a shared conversation, or a custom GPT. While the victim receives a normal answer, the attacker's task runs invisibly in a separate request stream when ChatGPT is in Thinking mode. The channel could also exfiltrate conversation history and files.
Read more: OpenAI Lets Developers Control Codex Coding Agent from ChatGPT Mobile App
According to the report, the containers had no route to the open internet and no direct link to each other, but they could use the Artifactory's Item Management API operations, specifically Set Item Properties and Get Storage Item Information. Reader credentials sitting in the container's environment variables carried enough permission for both calls, and property values could carry text or Base64-encoded binary content, with large data chunked and reassembled across accounts.
The attack's scope depends on the victim's data, tools, connected apps, and permissions. ChatGPT can access services such as Gmail, Google Drive, Microsoft Teams, and GitHub, making the potential impact broad. The research, published on September 8, 2026, was conducted by Alexey Bukhteyev, who discovered the channel independently in June 2026.
According to the researchers, the technique differed from what OpenAI described in its postmortem on the Hugging Face incident, though both cases showed an internal service shared between supposedly isolated environments turning into a path for passing data.
This finding follows Check Point Research's earlier work on security issues in AI platforms, including an August report on exploiting Cloudflare Code Mode and Workers.
