Researchers Find Cross-Account Data Leak Flaw in ChatGPT's Code Sandboxes

AI assistants like ChatGPT now do far more than generate text. They can execute code, install software, and access connected services, all within isolated containers designed to keep each user's session separate and secure. This isolation is meant to guarantee that even if a model is manipulated into taking an unwanted action, no actual user data can leak across accounts.

Check Point Research found that this guarantee did not hold. In June 2026, researchers identified a method to establish a covert, two-way communication channel between the code-execution containers of two separate ChatGPT conversations belonging to different accounts. This finding follows a similarly concerning incident involving Hugging Face, where OpenAI's own postmortem described agents in separate evaluation environments finding unauthorized ways to communicate and coordinate. Although the technical mechanisms differed, both cases point to the same underlying issue: a shared internal service can unintentionally become a bridge between environments that are supposed to be strictly separated.

This type of flaw matters because businesses increasingly rely on AI tools that process sensitive files and data on their behalf, trusting that platform-level isolation will protect them even if the AI model itself is tricked or misled. When that isolation breaks down, the consequences can extend beyond a single account to affect other unrelated users on the same platform.