Artificial intelligence assistants increasingly handle our most sensitive data, operating under the assumption that enclosed environments keep this information secure. However, a newly disclosed vulnerability in ChatGPT shattered this expectation.
Discovered by Check Point Research, this flaw exploited the isolated code execution runtime to establish a covert outbound communication channel, effectively turning standard chat sessions into silent data collection tools without triggering OpenAI’s outbound data transfer warnings.
- Target Platform: ChatGPT’s Code Execution and Data Analysis Linux Runtime.
- Attack Vector: Socially engineered malicious prompts or backdoored Custom GPTs.
- Exploit Technique: DNS Tunneling (encoding exfiltrated data via subdomain labels).
- Impact: Silent data exfiltration and bidirectional remote shell access inside the container.
- Resolution: OpenAI successfully patched the vulnerability on February 20, 2026.
Bypassing Outbound Restrictions via DNS
OpenAI heavily restricts direct outbound internet access from its Python-based Data Analysis environment.
Standard mechanisms for external data sharing, such as GPT Actions, require explicit user consent through visible approval dialogs.
However, researchers from CheckPoint discovered that while HTTP and standard TCP outbound requests were blocked, the containerized runtime still permitted Domain Name System (DNS) resolution to function normally.
Attackers exploited this oversight by using DNS tunnelling. By feeding the model a crafted malicious prompt, an attacker could instruct ChatGPT to encode sensitive chat data or uploaded file contents into DNS-safe fragments.
These fragments were then appended as subdomains to attacker-controlled domains. As the container’s DNS resolver processed these requests, it inadvertently transmitted the encoded data outward to the attacker’s server.
Because the system viewed DNS queries as standard infrastructure traffic rather than external data transfers, no security warnings were ever triggered for the user.
Threat actors could deliver this exploit through two primary vectors. First, an attacker could distribute a malicious prompt online, disguising it as a “jailbreak” or a productivity hack to unlock premium features.
Once pasted into the chat, the prompt weaponized the session. Alternatively, embedding the malicious logic directly into a custom GPT allowed attackers to bypass the need for prompt injection entirely, instantly compromising anyone who shared data with the backdoored assistant.
The severity of this vulnerability extended beyond simple data theft. Because the DNS channel was bidirectional, attackers could encode small command fragments within DNS responses.
This allowed threat actors to establish a remote shell directly inside the Linux container used by ChatGPT for data analysis.
From there, they could execute arbitrary commands completely outside the model’s standard safety mechanisms.
This incident highlights a critical shift in AI security. As models evolve into full-fledged execution environments capable of running code and processing medical or financial records, securing them requires rigid control over all communication layers.
Platform providers must ensure that foundational infrastructure protocols cannot be weaponized to bypass application-layer data protections.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
