Check Point researcher tells LDS why AI isolation needs more than a sandbox

Check Point security researcher Alexey Bukhteyev disclosed that ChatGPT containers in a research demonstration could not communicate directly but reached the same internal JFrog Artifactory service using credentials available inside each environment, allowing cross-account data leakage through shared repository-item properties, according to a September 8 technical report. Bukhteyev told Lets Data Science that "the prompt steered the model into performing the task; the infrastructure provided the unintended cross-account path," and Check Point said the specific channel is no longer available. The finding matters because separate containers can still share a data path when both can write to and read from the same resource, so teams connecting agents to private business data must enforce per-account permissions and review tool activity, not just the final answer.

Check Point researcher tells LDS why AI isolation needs more than a sandbox In written answers to LDS, Check Point's Alexey Bukhteyev explains the shared-service flaw behind a now-closed ChatGPT data channel, what his team retested, and what to check before giving an agent access to private business data. An AI assistant can give a useful answer while doing something its user never asked for. In a Check Point research demonstration, a ChatGPT session answered an ordinary request while retrieving data from a connected Gmail account and passing it to another account through an internal service. The specific channel is no longer available, according to Check Point. In written answers to Lets Data Science, Alexey Bukhteyev, a security researcher at Check Point , explained why the case matters beyond that closed path: restricting a container's network connections is only part of keeping one user's data separate from another's. His answers distinguish the instruction that redirected the model from the infrastructure that made the transfer possible. They also explain what the researchers retested and what customers should ask before connecting an agent to private business data. The gap between separate containers and separate data A sandbox is a restricted environment in which a program can run. Bukhteyev said the ChatGPT containers in this research could not communicate directly with one another. They could, however, reach the same internal JFrog Artifactory service using credentials already available inside each environment. That service supported package delivery. The credentials were intended for reader access, Bukhteyev said, but also allowed persistent state to be changed. One account's container could make a change that a different account's container could observe. The September 8 technical report https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/ identifies repository-item properties as that shared state. These are metadata attached to items in the package service. In the tested configuration, they became a place where separate accounts could leave information for each other. Bukhteyev told LDS: "The prompt steered the model into performing the task; the infrastructure provided the unintended cross-account path." This is an important distinction for anyone evaluating agent security. A model might reject an instruction today and accept a differently worded version tomorrow. The infrastructure still needs to enforce which account may read or change a resource, even when the model requests the wrong action. Bukhteyev described the underlying issue as shared mutable state: information that more than one environment can both change and observe. Separate containers can still share a data path if both can write to and read from the same resource. The reported problem concerned the permissions and separation of this particular internal service; it does not establish that every Artifactory deployment has the same weakness. Why a normal answer was not enough evidence of safety The public report describes a shared-conversation demonstration in which a hidden instruction was already in the conversation context. The user then sent an ordinary message. The session retrieved Gmail data while producing its visible answer. The scope depended on the tools, data and permissions already available to that session. This was a research demonstration, not evidence that arbitrary Gmail accounts could be read or that widespread customer compromise occurred. For a team building agents, the useful lesson is to examine tool activity as well as the final response. An answer can be correct while the steps taken to produce it include an unrelated action. Reviewing only the text shown to the user would miss that distinction. Bukhteyev's explanation also challenges a tempting assumption: an action that appears to stay inside a sandbox must be harmless. If a reachable service exposes shared state, a local-looking operation may have consequences outside that user's environment. Permission checks have to account for those consequences, rather than relying on the model's description of its task. What the retest established LDS asked Bukhteyev to separate the team's observations from confirmation received from OpenAI. He said Check Point validated its cross-account proof of concept on June 26, 2026 . In early July, the team tried the same technique again and found that the demonstrated channel no longer worked. It subsequently disclosed its findings to OpenAI. According to Bukhteyev, OpenAI later confirmed that the internal Artifactory instance identified in the research had been decommissioned. That sequence matters. The team's unsuccessful retest came before its disclosure. The information supplied to LDS does not establish that Check Point's disclosure caused the shutdown, and it does not give exact dates for the disclosure or OpenAI's confirmation. Bukhteyev said removing the affected instance eliminated the specific shared object used in the demonstration. He cautioned: "What this does not prove is that the same class of issue cannot exist elsewhere." He said other internal services reachable from sandboxed runtimes would need review for the same pattern. That is a recommendation for further assurance, not evidence that another service is currently vulnerable. LDS has not reproduced the exploit or independently tested the current ChatGPT environment. What to ask before connecting an agent to business data Bukhteyev recommended limiting an agent to the data and actions needed for its task, requiring clear approval for changes to external systems, treating instructions in emails and documents as untrusted, and making app activity visible. He emphasized that these are safeguards, not an exhaustive deployment checklist. For readers assessing a product or an internal agent, his answers suggest five practical questions: - • What can this task access? Ask which mailboxes, files, tools and credentials are available, and whether that access can be narrowed to the actual job. - • What is shared between customers or sessions? Ask the provider how it prevents one environment from reading changes made by another through internal services. - • Which actions require approval? Distinguish sending or modifying information from reading it. A sensitive read can matter even when nothing is changed in the source system. - • Can a document trigger a tool action? Ask how the system separates content it is supposed to analyze from instructions it is authorized to follow. - • What evidence can the customer inspect? Ask for records of app access and actions, and for an explanation of how account separation is tested. These questions translate the interview into an evaluation framework; they are not a claim that a particular product has passed it. Approval for sending email is valuable, but it does not by itself answer whether an agent should have read the confidential message in the first place. The enduring lesson from Bukhteyev's account is concrete: check the resources an agent can reach, not just the answer it produces. Closing the demonstrated channel addressed that route. Establishing confidence in an agent connected to business data requires evidence about permissions, shared services and observable actions as well. Reporting note Based on written answers from Alexey Bukhteyev supplied directly to Lets Data Science on September 17, 2026, and Check Point's September 8 technical report. The exclusive material is the written interview. Research observations and remediation details are attributed to Check Point; LDS did not independently reproduce the tests. His researcher affiliation is corroborated by his Botconf 2026 biography https://cfp.botconf.org/botconf-2026/speaker/P3BTZB/ . Key Points - 1Check Point says the demonstrated cross-account channel stopped working in an early-July retest; the affected internal service was decommissioned. - 2Alexey Bukhteyev distinguishes the instruction that redirected the model from shared infrastructure that allowed information to cross accounts. - 3His advice for agent users focuses on limited access, approval, account separation and visible tool activity. Scoring Rationale Original written answers from Alexey Bukhteyev explain a now-closed cross-account data channel, the difference between model instructions and infrastructure permissions, firsthand retest sequence, remediation limits and practical agent-access questions. Sources Original reporting, with the public references used alongside it. LDS Exclusive Reporting based on written answers given directly to Let's Data Science by Alexey Bukhteyev, security researcher, Check Point . View 1 more source Practice interview problems based on real data 1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with. Try 250 free problems https://letsdatascience.com/problems