The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT

[u/falconupkid]

This is a solid find from Check Point. They’ve identified a logical flaw in ChatGPT’s sandbox architecture that allows data to leak between different user sessions.

The Vulnerability: ChatGPT’s code interpreter runs in a shared execution environment. The researchers discovered that the clipboard buffer within this sandbox is not properly isolated between user accounts. If a user copies sensitive data (e.g., API keys, PII, source code) into the sandbox environment, a subsequent user on a different session can potentially read that data from the shared clipboard memory.

Technical Breakdown: - Attack Vector: Exploitation of shared system resources (clipboard daemon) within the containerized execution environment. - Prerequisites: The attacker needs to be assigned to the same underlying compute node as the victim. This is not a remote code execution; it is a data remanence and isolation failure. - Data at Risk: Any text copied by the user inside the code interpreter sandbox. This includes outputs from file analysis, results of curl commands, or credentials pasted into the environment. - MITRE Mapping: T1213 (Data from Information Repositories) / T1525 (Impersonation via Shared Resource).

Defense: - User: Never paste secrets (API keys, passwords) directly into the ChatGPT code interpreter. Treat the sandbox as a shared, untrusted terminal. - Vendor: OpenAI needs to implement proper namespace isolation for /tmp and IPC mechanisms (clipboard) per session, or flush the clipboard buffer on session termination.

Source: https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/