ChatGPT Vulnerability Enabled Silent Leakage of Prompts and Sensitive Information

Artificial intelligence assistants increasinglyhandle our most sensitive data, operating under the assumption that enclosed environments keep this information secure. However, a newly disclosed vulnerability in ChatGPT shattered this expectation.

Discovered by Check Point Research, this flaw exploited the isolated code execution runtime to establish a covert outbound communication channel, effectively turning standard chat sessions into silent data collection tools without triggering OpenAI’s outbound data transfer warnings.

• Target Platform: ChatGPT’s Code Execution and Data Analysis Linux Runtime.
• Attack Vector: Socially engineered malicious prompts or backdoored Custom GPTs.
• Exploit Technique: DNS Tunneling (encoding exfiltrated data via subdomain labels).
• Impact: Silent data exfiltration and bidirectional remote shell access inside the container.
• Resolution: OpenAI successfully patched the vulnerability on February 20, 2026.

Bypassing Outbound Restrictions via DNS

OpenAI heavily restricts direct outbound internet access from its Python-based Data Analysis environment.

Standard mechanisms for external data sharing, such as GPT Actions, require explicit user consent through visible approval dialogs.

However, researchers from CheckPoint discovered that while HTTP and standard TCP outbound requests were blocked, the containerized runtime still permitted Domain Name System (DNS) resolution to function normally.

The severity of this vulnerability extended beyond simple data theft. Because the DNS channel was bidirectional, attackers could encode small command fragments within DNS responses.

This allowed threat actors to establish a remote shell directly inside the Linux container used by ChatGPT for data analysis.

From there, they could execute arbitrary commands completely outside the model’s standard safety mechanisms.

This incident highlights a critical shift in AI security. As models evolve into full-fledged execution environments capable of running code and processing medical or financial records, securing them requires rigid control over all communication layers.

Platform providers must ensure that foundational infrastructure protocols cannot be weaponized to bypass application-layer data protections.