Isolating every user in their own container doesn’t accomplish much if all the containers share a service with write permissions. Check Point Research showed that this is exactly what was happening with ChatGPT’s code execution, and the lesson applies to any multi-tenant agent platform.
Check Point Research described a covert channel that would let an attacker use a victim’s ChatGPT session to run hidden tasks with the tools, data, and connected apps available in that session. Each user runs code in their own isolated container, but those containers accessed the same internal package repository (JFrog Artifactory) to download dependencies.
The researchers observed that the credentials handed to the containers had enough permissions to attach and read metadata (properties) on repository items through Artifactory’s item management API, with no per-account isolation. By encoding data in those properties, containers belonging to different users could exchange information through the shared service: in the report’s words, a shared clipboard between isolated containers.
The delivery vector could be a malicious prompt, a shared conversation, or a custom GPT. Once active, the channel allowed one visible and one hidden task flow to be processed within the same turn. In the demonstration, ChatGPT retrieved data from the victim’s Gmail while responding normally to the visible question; the only clue was a discreet “Talked to Gmail” label.
This case is not a model failure or a jailbreak. It is a classic tenant-isolation failure in the infrastructure surrounding the model. Check Point stresses that agentic platforms must protect every resource the model has access to: internal APIs, shared state, credentials, and tools, with per-tenant isolation and least privilege.
If you buy AI platforms:
If you build your own agent platform: audit which credentials each sandbox receives, use read-only, per-tenant credentials for dependencies, and treat any shared resource as a potential side channel.
If you need a review of the isolation and permissions of your agents, write to us at info@guatemalia.com.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel