# The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT

ChatGPT code-execution containers across accounts shared an internal Artifactory whose item-property API lacked tenant isolation, enabling a covert cross-account channel to exfiltrate victim Gmail data.

- Payout: Research
- Severity: high
- Program: OpenAI
- Write-up by: stcpresearch
- Disclosed: 2026-09-08
- Write-up quality: 8/10
- Original: https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/
- Library page: https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt
- Tags: area:cloud domain:cloud impact:data-leak impact:internal-access kind:research platform:threat-intel sev:high tech:llm technique:chained vuln:info-disclosure vuln:misconfiguration

**Target:** Internal JFrog Artifactory storage API reachable from ChatGPT code-execution containers
**Root cause:** Containers of different accounts could all reach the same internal Artifactory, and its Item Management API allowed writing/reading string properties on shared cached items without per-account isolation, turning package-service metadata into a shared clipboard.
**Steps:**
1. From a container under account A, authenticate to Artifactory using credentials in environment variables.
2. `PUT /api/storage/{repoKey}/{itemPath}?properties=chatgpt_test_ts=<timestamp>` to attach a property to an auto-cached file.
3. From a container under account B, `GET /api/storage/{repoKey}/{itemPath}?properties` on the same file.
4. Observe account A's property name/value returned to account B, confirming cross-account read/write.
5. Chunk larger payloads into multiple property keys and Base64-encode binary data.
6. Embed an instruction in a shared conversation/custom GPT telling ChatGPT to poll the mailbox property and execute hidden tasks alongside visible requests.
7. Victim sends any message; ChatGPT reads Gmail via connected app and writes results back to the property for the attacker to retrieve.
**How found:** Reasoned that containers need package installs, so they must reach an internal Artifactory; hypothesized that shared mutable state on that service could bridge isolated containers. Tested by writing a timestamp property from one account's container and reading it from another account's container.
**Exploitation:** Attacker plants a hidden instruction via malicious prompt, shared conversation, or custom GPT. On the victim's next ordinary message, ChatGPT in Thinking mode processes a second task stream: reads the attacker's task from Artifactory item properties, executes it with the victim's session tools (e.g., connected Gmail read), and writes results back to the shared property. Default 'Important actions' permission auto-approves low-risk reads, so no confirmation appears; only a post-hoc 'Talked to Gmail' label is shown.
**Escalation:** Scope scales with whatever data, tools, connected apps (Gmail, Drive, Teams, GitHub) and permissions the victim's session holds; channel also exfiltrates chat history and uploaded files.
**Insight:** When a sandbox blocks internet but permits an internal package proxy, enumerate that proxy's management/metadata APIs (e.g., Artifactory item properties) as a covert shared-state channel; test whether mutable metadata is tenant-isolated across accounts.