Researcher Claims He Built a Secret Communications Channel Inside ChatGPT's Locked-Down Sandbox
A Palo Alto Networks security researcher showed at Black Hat 2026 how an attacker could trick ChatGPT into running malicious code, steal data from connected accounts, and relay that data out through a backdoor built from failed login messages. OpenAI says the key components have been removed.
Key points
- Simcha Kosman of Palo Alto Networks presented the attack chain at Black Hat USA 2026 in Las Vegas on 5 August.
- The proof-of-concept used a malicious spreadsheet to plant code inside ChatGPT's sandboxed computing environment, a locked, isolated digital room where the AI runs its calculations.
- Kosman reported five separate security findings to OpenAI on 23 March 2026; the company addressed all of them within the 90-day disclosure window that researchers customarily give vendors before going public.
- OpenAI says the element of its system that made the full attack possible was removed before the Black Hat presentation.
- No evidence of this attack being used against real ChatGPT users has been reported.
What exactly did the researcher do?
Kosman built a way for two separate, supposedly isolated ChatGPT sessions to pass secret messages to each other, using nothing but failed login attempts as a kind of morse code.
He started with a quirk in how ChatGPT handles web links depending on platform. Clicking a specially crafted ChatGPT link on an iPhone or Mac caused the AI to execute the embedded instruction immediately, with no chance to review it first. Windows and Android show a preview step before anything runs. That single difference opened the door to a one-click attack: send a malicious link by text message, the target opens it on their iPhone, and it's already running.
The link instructed ChatGPT to download a spreadsheet from a server the attacker controlled. Processing that spreadsheet also ran code hidden inside one of the cells, the same way a booby-trapped Excel file might fire a macro on a corporate laptop. That code set up background processes and manipulated what Kosman called the model's "reasoning" layer, the hidden Python scripting environment ChatGPT uses to think through complex tasks, to scoop up data from connected apps such as Google Drive or Gmail and stage it for collection.
How did the stolen data get out?
Getting data out of an isolated sandbox is the hard part. ChatGPT's sandbox has no direct connection to the open internet, which is precisely the point.
Kosman found a side door. ChatGPT sandboxes use a software package manager called JFrog Artifactory to download the programming tools they need. Multiple sandboxes share the same Artifactory back end. When too many login attempts happen for one username, that account gets locked, and that lockout state is visible across different sandboxes.
Kosman turned that lockout behaviour into a primitive communications channel. A "too many requests" error represented the binary digit 1; a plain "login failed" represented 0. By firing off login attempts against a pre-agreed set of usernames, the attacker's sandbox and the victim's sandbox could exchange binary messages, slowly but reliably. He used it to list files in another ChatGPT session, read their contents and alter them remotely. We've covered sandbox-escape research in 16 stories since 1 July 2026, but this covert-channel approach is new territory, and it's the detail worth watching as others try to replicate it.
Should ChatGPT users be worried right now?
The immediate risk is low. OpenAI removed the URL-execution behaviour and the Artifactory lockout mechanism before the Black Hat talk. The company told Dark Reading it doesn't view the research as a true escape from the sandbox or as unrestricted access to other customers' accounts.
All the same, the attack is a reminder that AI tools connected to personal accounts carry real data-access risk. Anyone who has linked ChatGPT to Google Drive or Gmail is granting the AI a read-and-write key to sensitive files. Our 23 July story on the AgentForger flaw showed how a connected-account vulnerability can hand an outsider persistent control inside an organisation.
| Finding | OpenAI's response |
|---|---|
| URL-executed commands on macOS and iPhone | Described as known, kept for compatibility |
| Reasoning injection | Marked out of scope |
| Artifactory denial-of-service issue | Username/password requirement removed |
| Cross-sandbox communication via lockout behaviour | Lockout behaviour removed |
| Scheduled-task URL laundering | Architecture changed in scheduled-tasks update |
If you use ChatGPT with connected apps, review which third-party services you've authorised under your account settings and remove any you don't actively use. Be cautious about clicking ChatGPT links sent by text or email on an iPhone or Mac, even from people you know.
