Check Point Research published a useful case study on a now-remediated ChatGPT sandbox isolation issue: separate code-execution environments, which should have remained isolated by account and conversation, were able to communicate through shared mutable metadata in an internal package service.

The technical detail matters less than the security lesson. Modern AI assistants are no longer just chat windows. They can run code, install dependencies, analyze uploaded files, and access connected services such as email, cloud storage, collaboration tools, and source-code platforms. That turns the assistant runtime into a real trust boundary.

What Check Point reported

According to Check Point, the proof-of-concept used a shared internal service reachable from separate code-execution containers. By writing and reading metadata on shared repository items, one account could create a covert cross-account channel with another account’s environment.

The researchers then showed how that channel could become more than a data path. A malicious instruction embedded in a shared conversation, prompt, or custom GPT could cause a victim’s AI session to handle a hidden task alongside the visible user request. In their demonstration, the visible conversation continued normally while the hidden task accessed data available through a connected Gmail account and returned results through the covert channel.

Check Point says the specific cross-account channel was no longer available by the time the report was completed, and OpenAI confirmed that the internal Artifactory instance involved had been decommissioned.

Source: Check Point Research — The Shared Clipboard Inside the Sandbox

Why this matters for SMBs and government contractors

Many organizations are connecting AI tools to Microsoft 365, Google Workspace, GitHub, Slack, Jira, ticketing systems, and internal document stores before they have mature governance around agent permissions. That creates a familiar security problem in a new wrapper: if an authorized runtime can be manipulated, its permissions become the attacker’s permissions.

For small businesses and government contractors, the risk is not theoretical. AI assistants may be used to summarize contracts, draft proposals, review source code, analyze logs, process customer data, or search internal email. If those sessions can access sensitive repositories or connected apps without strong approval controls, a prompt-level compromise can become a data-access incident.

Defensive takeaways

  • Treat AI workspaces like privileged applications. Inventory which AI tools are connected to email, cloud drives, code repositories, ticketing platforms, and collaboration systems.
  • Default connected apps to explicit approval. If a platform offers an “always ask” or per-action confirmation mode, use it for email, file repositories, customer data, and source code.
  • Separate experimentation from production data. Do not test shared prompts, public GPTs, browser extensions, or untrusted agent workflows in the same account that can access business-sensitive systems.
  • Minimize AI-accessible data. Use least privilege, separate service accounts where supported, and short-lived access where possible.
  • Monitor for unexpected app activity. Review audit logs for AI-connected apps, especially read activity against email, file storage, and repositories that does not match user intent.
  • Require review before adopting custom agents. Custom GPTs, agent templates, and shared conversations should be treated like third-party code when they can influence actions inside an authenticated session.

Bulwark Black assessment

This report is another reminder that agentic AI security is not just prompt filtering. The runtime, package paths, internal services, shared state, connected apps, and approval model all have to be designed as one security system.

The practical control is boring but effective: reduce what the AI session can reach, make sensitive actions visible before they happen, and keep untrusted prompts away from accounts with business-critical access. If an AI assistant can read the inbox, query the repo, or browse the drive, it belongs in the same governance conversation as SaaS identity, endpoint security, and third-party risk.