Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise NEWSLETTER SIGN-UP Cybersecurity Topics World The Edge DR Technology Events Resources СLOUD SECURITY APPLICATION SECURITY MOBILE SECURITY DATA PRIVACY NEWS Researcher Claims Control of ChatGPT Secure Sandbox A researcher demonstrated a proof-of-concept attack chain that provided C2-style influence over ChatGPT's isolated sandbox during a session at Black Hat USA 2026. Alexander Culafi,Senior News Writer,Dark Reading August 6, 2026 5 Min Read SOURCE: DICZMAN VIA GETTY IMAGES Black Hat USA 2026 – Las Vegas – A researcher presented a proof-of-concept attack this week claiming to establish full command and control inside an isolated ChatGPT sandbox. On Aug. 5, Simcha Kosman, senior security researcher at Palo Alto Networks, presented "A Billion-User Blast Radius: Owning ChatGPT's Secure Sandbox" at Black Hat USA 2026. Among other things, the presentation demonstrated a proof-of-concept attack chain against ChatGPT's secure sandbox, apparently bypassing the large language model (LLM) supervisor in order to achieve persistent root execution. LOADING... While this is a proof of concept and not necessarily an attack against a realistic enterprise defender environment, the findings are interesting because the container sandbox is specifically designed to run as a secure, isolated runtime environment with strict controls. Anything that could possibly get around that would be worth calling attention to, even under theoretical circumstances. Related:Ghost Credentials Expose Cloud Systems to Hidden Identity Risks Kosman opened the presentation with what he described as a foundational assumption: "Private chats should stay private." But even in the case of an isolated sandbox, what should stay private is not always what will stay private. Kosman demonstrated how one could trick a victim's ChatGPT into running attacker-controlled code inside its sandbox, use the code to influence future reasoning, and abuse a shared back end to establish full command and control (C2), where data is passed from the victim's sandbox to the attacker's own sandbox. An OpenAI spokesperson tells Dark Reading the company was aware of the research ahead of the Black Hat presentation and appreciates Kosman sharing his findings. They said the aspect of OpenAI's system involved in the proof-of-concept was removed prior to the presentation; and that in the company's view, the research does not represent an escape from ChatGPT's security sandbox or unrestricted access to other customer accounts. LOADING... How The Sandbox Attack Works "Our first goal is to get sensitive information into the sandbox without being blocked by the LLM," Kosman said. "And the second goal is to send the information from the sandbox back to my server." The concept behind the attack began when Kosman discovered the differing ways ChatGPT handles URL-based instructions depending on which platform from which the URL is clicked on. On Windows and Android, the user clicks a ChatGPT link, and the prompt can be reviewed by the user prior to submission. Yet on an iPhone or Mac, URL-based commands were executed immediately upon the opening of a link. Related:'Confused Deputy' Flaws Persist in Google Cloud, Microsoft Azure This created an opportunity for a single-click attack, in which the attacker sends a malicious ChatGPT link (perhaps via SMS), the user opens it, and the attacker command is executed automatically. The next step was to get ChatGPT to download a spreadsheet from an attacker-controlled cloud location. Kosman found that when the AI model processed spreadsheets, it would also process and execute code contained within the spreadsheet. And by placing malicious code in a spreadsheet cell, ChatGPT would execute the code during processing. This malicious code could also be used to create persistent and unsupervised processes in the background. Then, Kosman found that by patching the model's hidden Python execution environment used by ChatGPT for its reasoning or "thinking" process, he could trick the model into extracting data from connected tools (which may include critical utilities like Google Drive and Gmail) into the defender sandbox, staging it for data exfiltration. ChatGPT C2 Achieved The most complex, final step was to move data from the defender sandbox to an attacker-controlled environment. While he initially thought the sandbox had Internet access and could simply send data to an external server, this was not the case. The opportunity came with JFrog's Artifactory repository manager, used by ChatGPT sandboxes for managing software binaries. Related:Default Azure Automation Setting Enables Cross-Tenant Identity Takeover The researcher found not only that multiple sandboxes interacted with the same Artifactory back end, but that account lockout behavior could be viewed across accounts. Moreover, these denial-of-service states could actually reach an otherwise isolated sandbox in the form of login attempts. Kosman determined he could get attacker and defender sandboxes to talk to each other by having the sandboxes interpret login states as binary code. "Too many requests" represented binary 1, and "login failed" represented 0. An attacker agent and a victim-side agent established through the malicious spreadsheet payload would use repeated login attempts with a wide range of agreed-upon usernames to send binary messages to one another. One sandbox would intentionally trigger lockouts for specific usernames, while the other would query those usernames and interpret the responses as bits. While slow and simple, it was two-way. The rudimentary C2 allowed the researcher to access a list of files belonging to another ChatGPT session, read the file contents, and modify said contents remotely. Putting it all together, the attacker sends a malicious command via a URL to a ChatGPT user on an iPhone or Mac. The instruction downloads a spreadsheet from an attacker-control location. The spreadsheet includes malicious code that establishes persistence, injects reasoning into the victim's ChatGPT to move sensitive data into the victim sandbox, and uses the shared Artifactory authentication state as a covert channel, encoding bits through account lockouts that could be observed from another sandbox. By the end of the presentation, Kosman said the team had achieved "full C2 communication entirely inside ChatGPT sandbox." A spokesperson for Palo Alto Networks tells Dark Reading Kosman reported five findings connected to this research to OpenAI on March 23: prompt execution through a URL parameter on macOS and iPhone; reasoning injection; a denial-of-service issue involving Artifactory; cross-tenant communication through Artifactory via the username lockout behavior; and URL laundering through scheduled tasks. OpenAI's responses "varied by finding." "They said the first behavior was a known issue retained for compatibility reasons, and they marked the reasoning-injection report as out of scope. For the Artifactory issues, they removed the requirement to provide a username and password when downloading packages, while keeping the low-privilege reader user for compatibility reasons. They also removed the user lockout behavior that enabled the cross-tenant communication," the spokesperson says. "For the scheduled-task issue, they changed the architecture to prevent URL laundering as part of the recent major scheduled-tasks update." All responses and changes occurred within the 90-day disclosure window, the spokesperson adds. Read more about: Black Hat News About the Author Alexander Culafi Senior News Writer, Dark Reading Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Search Security, Nintendo World Report, and elsewhere. At Dark Reading, he covers a variety of cybersecurity topics, including the cybercrime ecosystem, open source security, and the intersection between AI and threat actors. In his spare time, Alex hosts the weekly Nintendo podcast, "Talk Nintendo Podcast," and works on personal writing projects, including two previously self-published science fiction novels. He has received numerous awards, including TechTarget's Writer of the Year in 2022 as well as more than 10 Azbee awards for his reporting between 2022 and today. Want more Dark Reading stories in your Google search results? ADD US NOW More Insights Industry Reports The State of Cloud Security: The Latest Challenges How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy Essential News & Insights from Black Hat USA 2025 Access More Research Webinars Building a Secure AI Strategy for the Enterprise Is your AppSec program Mythos Ready? Experts Explain How to Develop a Framework for Cyber-Fraud Fusion Prevention at Machine Speed: Hunting Beyond Known Detections 0-Day to 10x Discovery: Security at the Speed of Mythos More Webinars You May Also Like СLOUD SECURITY TeamPCP Turns Cloud Infrastructure Into Crime Bots by Jai Vijayan FEB 09, 2026 СLOUD SECURITY The Cloud Edge Is the New Attack Surface by Robert Lemos SEP 17, 2025 СLOUD SECURITY Phishing Empire Runs Undetected on Google, Cloudflare by Elizabeth Montalbano SEP 04, 2025 СLOUD SECURITY DARPA: Closing the Open Source Security Gap by Alexander Culafi AUG 21, 2025 Black Hat USA Coverage CYBERSECURITY OPERATIONS From Bobmojis to Bobbleheads: How the Democratic Party Built a Security-First Culture byArielle Waldman AUG 6, 2026 4 MIN READ THREAT INTELLIGENCE AI Sends Global Crime Syndicates Into Fraud Nirvana byTara Seals AUG 5,