# ChatGPT: Lack of Isolation between Code Interpreter sessions of GPTs

ChatGPT Code Interpreter uses one shared container per user across all GPTs, letting any third-party GPT read and overwrite files from other chats and private GPTs.

- Payout: Research
- Severity: high
- Program: OpenAI
- Write-up by: Johann Rehberger
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2024/lack-of-isolation-gpts-code-interpreter/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-lack-of-isolation-gpts-code-interpreter
- Tags: area:ai domain:ai impact:data-leak impact:integrity kind:research platform:research sev:high tech:llm technique:recon vuln:access-control vuln:info-disclosure vuln:misconfiguration

**Target:** ChatGPT Code Interpreter / Advanced Data Analysis sandbox (/mnt/data)
**Root cause:** A single Code Interpreter compute container and its storage are provisioned per user and reused across all ChatGPT and custom GPT sessions instead of being isolated per GPT/session.
**Steps:**
1. Start a new ChatGPT chat, upload a test file or ask it to create one.
2. Ask ChatGPT to list files in `/mnt/data` and confirm the file exists.
3. Open a new chat with a third-party or self-created GPT that has Code Interpreter enabled.
4. Ask that GPT to list files in `/mnt/data`; observe the same files are visible and can be overwritten.
5. Optionally ask for the hostname in both sessions to confirm the same container.
**How found:** Author compared hostnames and `/mnt/data` listings across separate ChatGPT and custom GPT sessions and noticed identical container state, then tested whether files persisted and were writable across GPTs.
**Exploitation:** A malicious GPT creator enables Code Interpreter and instructs the model to enumerate `/mnt/data`, exfiltrate or overwrite files left by the victim's other ChatGPT/private GPT sessions, including uploaded personal data and custom knowledge files copied into CI.
**Escalation:** Private GPT custom knowledge files are copied into the shared CI space once Code Interpreter is invoked, so private knowledge can leak to other GPTs; other GPTs can also write files that influence the victim's GPT.
**Insight:** When a platform reuses a per-user sandbox across tenant-defined apps (GPTs), test cross-app state: compare hostnames and shared mount paths like `/mnt/data` between sessions, and check whether app-specific secrets (custom knowledge) get copied into that shared space.