A researcher says a shared login lockout let ChatGPT sandboxes signal each other

At DEF CON 34, Simcha Kosman showed how a shared login lockout let ChatGPT sandboxes on different accounts signal each other. The sandboxes had no open internet access. They still shared one package proxy, and that proxy kept one failed-login count for all of them.

What was said

Kosman said the sandbox could reach only a JFrog Artifactory proxy, a server that supplies software packages. An install command goes there, not to the public npm site. The proxy's username and password sat in clear text in an environment variable, he said, shared in every sandbox.

He tried logging in with a wrong password from inside a sandbox. The first try said login failed. The second said too many requests. A sandbox on a completely different account got the too-many-requests answer at once. A username that did not exist behaved the same way. Kosman said that "that is shared between all the sandbox."

That shared state became a signal. A sender and receiver agree on a list of usernames, one per bit of a message. The sender triggers a lockout on each username that stands for a one. The receiver tries every username. A failed login reads as zero and too many requests reads as one.

His first test failed. OpenAI ran three proxy nodes behind a load balancer, so the counts were split. He fixed it by retrying until he saw three failures. In his demo, the victim was an enterprise account and the attacker a private one. The attacker listed files and read a secret in the victim's sandbox.

Why it matters

Our reading: isolation claims should be tested against what tenants still share. A rate limit is shared memory. So is any counter, cache or error message that behaves the same for everyone.

For buyers, no internet access does not prove there is no path out. Ask vendors which services sit between tenants, and whether limits are counted per customer. In Kosman's demo, account tier did not stop the signal.

The other side

The lockout channel was one step in a longer chain. Kosman's show notes say it began with abusing spreadsheet parsing to run code that the AI supervisor did not filter. The signal then needed code running in both sandboxes. In his flow, a user had to press a link sent by text message to start the victim's side. It also needed retry loops to cope with the three load-balanced nodes.

The excerpts do not say whether OpenAI has since changed the proxy's lockout behavior. Kosman described a billion-user blast radius, but the excerpts show no test at that scale. He noted that OpenAI had already blocked two other leaks, and he closed by saying "never say never. Everything is possible."