Check Point Research has disclosed a now-closed security issue in ChatGPT that it says created a covert channel between separate user accounts and could be used to make one user’s session access data through connected services such as Gmail.

The researchers said the path relied on shared internal infrastructure used by ChatGPT’s code-execution environment rather than a direct connection between accounts. OpenAI was notified of the finding and, according to Check Point, confirmed that the specific internal JFrog Artifactory instance involved has been decommissioned.

Check Point said the particular route described in its proof of concept is no longer exploitable. The research nevertheless highlights a broader problem for connected AI assistants: a system may inherit access to email, files and other services from a legitimate user, making the assistant’s permissions valuable to an attacker even when the underlying account credentials are not stolen.

A shared service became a cross-account channel

In its September 8 research disclosure, Check Point said ChatGPT code-execution containers were isolated from one another but could all reach an internal package-delivery service based on JFrog Artifactory.

The service was used to support software package access without giving individual containers unrestricted internet connectivity. Check Point said it found that containers could write and read shared metadata attached to repository items. That behavior created what the researchers described as a two-way channel between containers belonging to different ChatGPT accounts.

In the proof of concept, one account could leave a task in the shared service for another account’s session to retrieve. A planted instruction could cause the victim’s session to check that channel during an otherwise ordinary interaction, carry out the hidden task using the victim’s existing permissions, and return the result through the same shared infrastructure.

The researchers said the instruction could be delivered through several routes, including a malicious prompt, a shared conversation link or a custom GPT containing hidden instructions. Check Point did not present the disclosure as evidence that the technique had been used in a broad real-world campaign against ChatGPT users.

Connected apps increased the potential impact

The impact depended on what the victim had already allowed ChatGPT to access. In Check Point’s demonstration, the victim’s session retrieved information from a connected Gmail account and passed it back to the attacker’s session while the visible conversation continued normally.

According to the research, the same architectural issue could potentially have exposed information available through other connected services if the user’s session already had permission to read them. The central security concern was therefore not just cross-account communication. It was the ability to combine that communication path with legitimate permissions granted to an AI assistant.

TNGlobal has previously published a contributor piece on how AI agents become harder to secure once they can act across enterprise systems. Prompt injection and hidden instructions become more consequential when an assistant can read corporate email, retrieve files, invoke tools or initiate workflows rather than simply generate text.

OpenAI decommissioned the affected infrastructure

Check Point said it disclosed the issue to OpenAI and that the specific Artifactory instance identified in the research was subsequently decommissioned. The researchers explicitly state that the path described in the disclosure is not still exploitable today.

The company also connected the finding to the same internal Artifactory infrastructure later associated with a separate Hugging Face incident previously discussed by OpenAI. Check Point stressed that the two were not the same attack and did not use the same technique.

For security teams, the more durable lesson is that shared infrastructure supporting AI agents can become part of the attack surface even when user sessions themselves are designed to be isolated. Internal package repositories, metadata services, connectors and tool gateways may all carry assumptions about trust that become risky once many autonomous or semi-autonomous sessions can reach them.

Permissions matter as much as model behavior

The disclosure also reinforces why organizations need visibility into which AI assistants employees use and which corporate systems those assistants can access. A model does not need to be compromised in the traditional sense if an attacker can manipulate its instructions and then take advantage of permissions the user has already granted.

That puts more weight on least-privilege access, monitoring of agent actions, connector governance and controls around sensitive reads. Enterprises deploying connected AI assistants may also need to treat tool calls and cross-system activity as security events in their own right rather than focusing only on whether a model produced an unsafe answer.

Check Point’s finding involved a specific path that has been closed, but the design pattern is broader. As AI assistants gain access to more business systems, the boundary between application security, identity security and AI safety becomes increasingly difficult to separate.

Featured image: Justin Morgan on Unsplash

When AI agents start acting on our behalf, security gets more complicated