A security researcher has unveiled a proof-of-concept attack that compromises the isolated sandbox of popular chatbot ChatGPT, allowing an attacker to establish full command and control (C2) over the system. The findings, presented at Black Hat USA 2026 by Simcha Kosman, senior security researcher at Palo Alto Networks, demonstrate a complex chain of vulnerabilities that can be exploited to bypass even the most secure sandbox environments.
The attack begins with a single-click vulnerability, where an attacker sends a malicious ChatGPT link to a victim’s device. When the user clicks on the link, the prompt is executed automatically, allowing the attacker to inject code into the system. From there, the attacker can trick ChatGPT into downloading and executing malicious code from an attacker-controlled cloud location, which can be used to create persistent and unsupervised processes in the background.
The most concerning aspect of this attack is its ability to extract sensitive data from connected tools, such as Google Drive and Gmail, and stage it for exfiltration. This is achieved by patching the model’s hidden Python execution environment, which allows the attacker to trick ChatGPT into extracting data from these connected tools.
To move the extracted data out of the sandbox, the attacker must rely on a third-party service – in this case, JFrog’s Artifactory repository manager. While ChatGPT sandboxes do not have direct internet access, they can communicate with external services through this repository manager. The attacker can use this vulnerability to send the stolen data to an attacker-controlled environment.
While OpenAI, the company behind ChatGPT, has stated that the research does not represent an escape from the chatbot’s security sandbox or unrestricted access to other customer accounts, the findings are still significant. They highlight the importance of secure design and testing in even the most isolated environments, and demonstrate that no system is completely secure.
The attack chain presented by Kosman is complex and requires a specific set of circumstances to occur, but it serves as a reminder that security vulnerabilities can be found even in the most well-designed systems. As more users rely on chatbots like ChatGPT for sensitive information exchange, the risk of these types of attacks becomes increasingly significant.
For users, this means being vigilant when interacting with chatbots and avoiding suspicious links or prompts. For developers, it highlights the need for rigorous testing and secure design practices to prevent vulnerabilities like those demonstrated by Kosman’s research. Ultimately, this attack serves as a reminder that security is an ongoing process, and even the most secure systems can be compromised if not properly maintained.
Source: Dark Reading — 2026-08-06