-
A security researcher unveiled a proof-of-concept attack that would allow establishing command-and-control within ChatGPT’s isolated sandbox at the Black Hat USA 2026 event.
-
This attack took advantage of discrepancies in processing URL commands on different platforms, malicious spreadsheets running code, and the same back-end being used to create an alternative communication channel.
-
OpenAI addressed the vulnerabilities before the presentation but maintains the research does not represent an actual sandbox escape or unrestricted access to customer accounts.
Simcha Kosman, a Palo Alto Networks senior security researcher, has demonstrated a proof-of-concept attack that could give hackers command-and-control (C2) influence inside ChatGPT’s supposedly secure sandbox.
He presented the research, titled “A Billion-User Blast Radius: Owning ChatGPT’s Secure Sandbox,” on August 5 at Black Hat USA 2026 in Las Vegas.
Kosman explained how the attacker can make the victim’s ChatGPT run some malware, affect its reasoning process in the future and allow establishing bidirectional communication between two sandboxes.
Even though this is still a proof-of-concept and not a practical attack, there are some vulnerabilities in AI security that need to be considered. The findings from the research have made the researchers question the efficiency of the AI isolation practices.
The Attack Chain: From One Click to Full Control
The attack began with a simple observation. Kosman discovered that ChatGPT handles URL-based commands differently depending on the platform. On Windows and Android, clicking a ChatGPT link lets users review the prompt before it submits.
But on iPhones and Macs, commands execute immediately when the link opens. This created an opening for a single-click attack. The attacker may send a bad link in ChatGPT via SMS and other modes of communication. If the user who is using the Apple device clicks on it, then the commands of the attacker will be automatically executed.
Next, Kosman needed ChatGPT to download a spreadsheet. He hosted one on a cloud server he controlled. When the AI processed it, something unexpected happened. The spreadsheet contained code.
ChatGPT executed that code without asking. Hidden inside a single cell, the malicious commands created background processes that kept running even after the chat ended. Nobody was watching them. That gave Kosman his opening.
From there, Kosman patched the hidden Python execution environment in the model, which ChatGPT uses for its reasoning or “thinking” process.
This allowed him to trick the model into extracting data from connected tools like Google Drive and Gmail. The stolen data would then be staged inside the victim’s sandbox, ready for exfiltration.
Building a Covert Communication Channel
Then Kosman hit a wall. He needed to move data from the victim’s sandbox to an attacker-controlled environment. He initially assumed the sandbox had internet access and could simply send data out. That turned out to be wrong. The sandbox didn’t have any form of interaction with the open web.
But he found an unexpected workaround through JFrog’s Artifactory repository manager, which ChatGPT sandboxes use to manage software binaries. Multiple sandboxes interacted with the same Artifactory back end.
Here’s what made it possible: account lockout behavior could be observed across different accounts. These denial-of-service states have the potential to reach an otherwise isolated sandbox via login attempts.
Kosman realized he could turn login states into binary code. ‘Too many requests’ meant binary 1. ‘Login failed’ meant zero. Crude, but it worked.
A victim-side agent and an attacker agent, both established using a malicious spreadsheet payload, would utilize multiple login attempts with agreed-upon usernames to send binary messages back and forth.
One sandbox would trigger lockouts for specific usernames. The other would query the usernames and then interpret the responses in the form of bits.
Although it was slow and crude, it worked both ways. The rudimentary C2 channel allowed the researcher to access files from another ChatGPT session.
It also allowed him to read file contents and even modify them remotely. At the end of his presentation, Kosman confirmed his team had achieved complete C2 communication entirely within the ChatGPT sandbox.
The findings come amid heightened attention to sandbox security. A separate online claim falsely (as of the time of writing) alleged that OpenAI models had escaped their sandbox to hack Hugging Face, though the actual incident involved different agents exploiting the same Artifactory repository vulnerability.
OpenAI’s Response and Remediation
An OpenAI spokesperson said the company was aware of the research ahead of the Black Hat presentation. The company appreciated Kosman sharing his findings. They noted that the aspect of the system involved in the proof of concept was removed prior to the presentation.
OpenAI pushed back on that. According to the company, the interpretation doesn’t represent an escape from ChatGPT’s security sandbox. And that it doesn’t represent unrestricted access to other customer accounts.
A spokesperson of Palo Alto Networks provided more details about the disclosure process. Kosman reported five findings to OpenAI on March 23. The first one was prompt execution through a URL parameter on iPhone and macOS.
The second was reasoning injection. Thirdly, he observed a denial of service issue involving Artifactory. The fourth finding was cross-tenant communication via Artifactory through username lockout behavior. And the fifth was URL laundering via scheduled tasks. OpenAI responded to each finding.
They addressed the first behavior as a known flaw retained for compatibility purposes. They marked the reasoning-injection report as out of scope.
For the Artifactory issues, they removed the requirement to provide a username and password when downloading packages while keeping the low-privilege reader user for compatibility.
They also removed the user lockout behavior that enabled cross-tenant communication. For the scheduled-task issue, they changed the architecture to prevent URL laundering. All the findings and patching took place during the customary 90-day disclosure window.
Although OpenAI has patched up all these issues, this research is an eye-opener about how even well-thought-out isolation strategies can have some vulnerabilities in them. As AI systems become more powerful and integrated into daily workflows, security researchers and developers will need to stay vigilant.
