Researcher Claims He Built a Secret Communications Channel Inside ChatGPT's Locked-Down Sandbox

Key points

• Simcha Kosman of Palo Alto Networks presented the attack chain at Black Hat USA 2026 in Las Vegas on 5 August.
• The proof-of-concept used a malicious spreadsheet to plant code inside ChatGPT's sandboxed computing environment, which is a locked, isolated digital room where the AI runs its calculations.
• Kosman reported five separate security findings to OpenAI on 23 March 2026; the company addressed all of them within the 90-day disclosure window that researchers customarily give vendors before going public.
• OpenAI says the element of its system that made the full attack possible was removed before the Black Hat presentation.
• No evidence of this attack being used against real ChatGPT users has been reported.

What exactly did the researcher do?

Kosman built a way for two separate, supposedly isolated ChatGPT sessions to pass secret messages to each other, using nothing but failed login attempts as a kind of morse code.

He started with a quirk in how ChatGPT handles web links on Apple devices. On an iPhone or Mac, clicking a specially crafted ChatGPT link caused the AI to execute the embedded instruction immediately, without giving the user a chance to review it. On Windows and Android, a preview step exists. That single difference opened the door to a one-click attack: send a malicious link by text message, the target opens it on their iPhone, and the attack begins.

The link instructed ChatGPT to download a spreadsheet from a server the attacker controlled. When ChatGPT processed the spreadsheet, it also ran code hidden inside one of the cells, the same way a booby-trapped Excel file might run a macro on a corporate laptop. That code set up background processes and manipulated what Kosman called the model's "reasoning" layer, the hidden Python scripting environment ChatGPT uses to think through complex tasks, to scoop up data from any connected apps such as Google Drive or Gmail and stage it for collection.

How did the stolen data get out?

Getting data out of an isolated sandbox is the hard part. ChatGPT's sandbox has no direct connection to the open internet, which is precisely the point.

Kosman found a side door. ChatGPT sandboxes use a software package manager called JFrog Artifactory to download the programming tools they need. Multiple sandboxes share the same Artifactory back end. Critically, when too many login attempts happen for one username, that account gets locked, and that lockout state is visible across different sandboxes.

Kosman turned that lockout behaviour into a primitive communications channel. A "too many requests" error represented the binary digit 1. A plain "login failed" represented 0. By firing off login attempts using a pre-agreed list of usernames, the attacker's sandbox and the victim's sandbox could exchange binary messages, slowly but reliably. Kosman used it to list files in another ChatGPT session, read their contents, and alter them remotely.

Should ChatGPT users be worried right now?

The immediate risk is low. OpenAI removed the URL-execution behaviour and the Artifactory lockout mechanism before the Black Hat talk. The company told Dark Reading it does not view the research as a true escape from the sandbox or as unrestricted access to other customers' accounts.

All the same, the attack is a reminder that AI tools connected to personal accounts carry real data-access risk. Anyone who has linked ChatGPT to Google Drive, Gmail, or similar services is granting the AI a read-and-write key to sensitive files.

If you use ChatGPT with connected apps, review which third-party services you have authorised under your account settings and remove any you do not actively use. Be cautious about clicking ChatGPT links sent to you by text or email, especially on an iPhone or Mac, even from people you know.