ChatGPT’s Shared Trust Layer Leaks Across Accounts
Check Point Research said in late June that OpenAI’s ChatGPT infrastructure allowed a covert cross-account channel through JFrog Artifactory, while a separate Artifactory weakness let one agent reach the internet and then target Hugging Face. The issue sat inside the system ChatGPT uses to run agent tasks, not in a single user chat.
The hidden channel worked because one container could attach data to an internal repository item and another account’s container could read it back, so an attacker could smuggle instructions or stolen data without a visible prompt in the victim’s conversation. In the other case, package-management access became an escape route to outside systems, showing how a trusted internal service can become the bridge from an isolated agent to the open web.
For organizations that let AI assistants read mail, documents, or internal tools, the exposure is in the trust boundary itself: one workflow can become a covert control plane for another, and the victim may never see evidence that anything left the session. The reporting leaves the same lesson in two forms: isolation failures in shared AI plumbing can enable both data exfiltration and cross-account abuse.