Black Hat USA 2026 in Las Vegas put AI runtime security under harsh light when Palo Alto Networks senior researcher Simcha Kosman unveiled a proof-of-concept exploit chain that he says can achieve command-and-control-style influence inside ChatGPT’s secure sandbox environment.[1][3][8] The talk, titled A Billion-User Blast Radius: Owning ChatGPT’s Secure Sandbox, described how an attacker could steer a victim’s ChatGPT session into executing malicious code in its isolated container and then use that foothold to persist, exfiltrate data and coordinate activity across sandboxes.[1][3][6][8]
According to conference materials and subsequent reporting, the attack begins by abusing file parsing of a seemingly benign spreadsheet to plant attacker-controlled code that survives across multiple interactions within the sandboxed environment.[1][3][6][8] Kosman then demonstrated live patching of the internal Jupyter kernel to hijack a hidden python.exec reasoning channel, enabling what he calls a “Reasoning Injection Attack” that lets the adversary quietly read and manipulate data the model processes for other users and tenants.[6][8] From there, the chain bypasses network isolation by weaponizing a Task Scheduler mechanism to launder malicious URLs past strict outbound guardrails, and finally turns globally visible authentication rate limits in a shared JFrog Artifactory package manager into a half-duplex covert signaling protocol for reliable C2 and data exfiltration between otherwise locked-down sandboxes.[6][7][8]
ThreatVectr’s summary of the research notes that Kosman privately reported five distinct findings to OpenAI on March 23, 2026, and that the company addressed all of them within the customary 90-day disclosure window before the Black Hat talk.[3] OpenAI removed the specific system behavior that made the full chain possible—including URL execution tied to Task Scheduler and the Artifactory lockout mechanism—prior to the public briefing, and there is currently no evidence that the attack has been used against real ChatGPT users.[3] The researcher and independent commentators describe the immediate risk as low because the exploit operates inside ChatGPT’s sandboxed execution environment rather than directly compromising core infrastructure, though the demonstrated cross-tenant data exfiltration shows that sensitive information can still be at risk when isolation controls fail.[3][6][8]
SecurityArsenal’s analysis emphasizes that, as of publication, no CVE identifier or CVSS v3/v4 score has been assigned to this research and OpenAI has not characterized it as an actively exploited vulnerability.[2] Instead, the work is framed as a composite exploit built from multiple weaknesses and design assumptions in ChatGPT’s sandbox architecture and AI supervisor layer, making it harder to capture in a single vulnerability record.[1][2][8] Even so, the talk lands in a broader context of documented ChatGPT issues: a separate file-download flow vulnerability, tracked as CVE-2025-43714, previously showed how path traversal inside the sandbox could expose restricted system files such as /etc/passwd, underscoring that AI sandboxes can surface traditional web flaws alongside model-specific problems.[9][13]
Commentary from Straiker and Shield53 argues that Kosman’s chain is among the most complete public exploit demonstrations against a production AI platform and highlights how far AI sandbox security lags behind mature isolation models in browsers and operating systems.[6][7] Earlier work from Check Point Research on hidden outbound communication paths from ChatGPT’s isolated runtime similarly warned that containerized AI code execution can leak data through side channels that evade standard network controls.[10] Together, these findings suggest that organizations deploying LLM-based tools should treat AI execution environments as high-value attack surfaces in their own right, rather than assuming a sandbox and some guardrails are enough to contain damage.[6][7][10]
Defensive guidance emerging from the Black Hat talk and subsequent write-ups focuses less on chasing a single bug and more on hardening the ecosystem around AI sandboxes.[2][6][7] Analysts recommend strict egress allowlisting for sandboxed runtimes, tight segmentation between AI workloads and sensitive back-end systems, and monitoring of sandbox activities for unusual patterns such as repeated authentication lockouts or unexpected outbound scheduling behavior that could indicate covert channels.[2][6][7] They also urge teams to mitigate prompt injection by controlling which external documents, web pages and retrieval sources models can ingest, and to treat uploaded files and tool outputs with the same skepticism and scanning rigor applied to traditional untrusted content.[2][7] While OpenAI’s fixes appear to neutralize this specific chain, the research reinforces that security teams must assume attackers are actively probing AI sandboxes for the next set of weak links.[1][2][6]
References
- Researcher Claims Control of ChatGPT Secure Sandbox
- ChatGPT Sandbox Escape at Black Hat USA 2026
- Researcher Claims He Built a Secret Communications Channel Inside ChatGPT’s Locked-Down Sandbox
- AI Agents Take Center Stage at Black Hat USA 2026
- ChatGPT Sandbox C2 Takeover PoC: Why AI Execution Environments Are the Next Attack Surface
- Simcha K.’s Post
- ChatGPT File Download Flow Vulnerability: Guardrail Bypass to …
- ChatGPT Data Leakage via a Hidden Outbound Channel in the Code …
- CVE-2025-43714 Detail – NVD
