Researchers detail former OpenAI Artifactory flaw that could enable cross-account data access

Check Point Research has described a now-closed issue involving an internal JFrog Artifactory service used by OpenAI code-execution environments. According to the researchers, the configuration could have allowed an attacker to pass hidden instructions between isolated ChatGPT sessions and potentially use a victim’s authorized app connections to retrieve data.

The researchers said they notified OpenAI in late June. By that point, OpenAI had already retired the Artifactory instance, reportedly following a separate incident involving AI agents and Hugging Face. Check Point said its finding was distinct from that intrusion, although both cases involved the same internal package-management system.

How the channel worked

ChatGPT code-execution containers were designed without direct internet access, but could access an internal package repository. Check Point found that repository objects could carry text properties, including encoded data. A session associated with one account could write content to the shared service, while a separate user’s session could read it.

The researchers also reported that credentials intended for repository reading permitted write actions. Because code running in a session could authenticate to the service, an attacker could allegedly store instructions that a victim’s session might later process.

In a proof of concept, Check Point used a shared ChatGPT conversation to demonstrate the risk. The visible user request was benign, such as generating a weather chart, while a concealed instruction directed the system to access a connected Gmail account and return information through the shared repository channel. The victim would not see the hidden instruction or the resulting data in the normal chat response, researchers said.

Broader AI security concerns

The potential impact depended on applications connected to the victim’s account. Beyond email, the researchers said similar access could have affected services such as cloud storage, collaboration platforms, source-code repositories and files available to the assistant.

• Shared internal services can undermine isolation if permissions are overly broad.
• Read-only credentials should not provide write capabilities.
• AI systems with access to connected applications need monitoring and controls for hidden or indirect instructions.

Check Point characterized the issue as an example of the risks created when AI agents can execute code, use credentials and access sensitive data. OpenAI did not provide a public response in the supplied report. With the affected Artifactory service decommissioned, the specific channel is no longer available, but the research highlights the need for stronger trust boundaries around agentic AI tools.