Case chatgpt-dns-runtime-leakPrompt injectionIsrael
Check Point finds DNS tunnel out of ChatGPT's code sandbox leaking chats and files
Check Point Research found ChatGPT's supposedly offline Python container could reach the internet via DNS, so one malicious prompt or custom GPT could exfiltrate messages and files or open a remote shell. OpenAI fixed it
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Mar 30, 2026
- Location
- Israel
- Target
- OpenAI ChatGPT code execution runtime
- Severity
- High
- Triggered by
- Check Point Research
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Check Point Research found ChatGPT's supposedly offline Python container could reach the internet via DNS, so one malicious prompt or custom GPT could exfiltrate messages and files or open a remote shell. OpenAI fixed it
Impact: Silent exfiltration of conversation data including health and financial content; no exploitation reported
Who triggered it
Actor: Check Point Research
Attribution: Responsible disclosure; OpenAI said it had identified the problem internally
Motive: Security research
How it happened
Attack vector: Prompt injection causing the runtime to encode data in DNS subdomain lookups; DNS responses carried commands back
Root cause: DNS resolution remained enabled inside a sandbox described as having no outbound network access
Timeline
- OpenAI fix fully deployed
- Check Point publishes the research
Response
OpenAI closed the DNS channel in the code execution environment
Current status: Patched
Sources (open in a new tab)
- Check Point Research research.checkpoint.com
- The Register theregister.com
- CSO Online csoonline.com
Cite this case
Check Point finds DNS tunnel out of ChatGPT's code sandbox leaking chats and files. AI Threat Watch, case chatgpt-dns-runtime-leak, Mar 30, 2026. https://aithreat.io/cases/chatgpt-dns-runtime-leak/
Permanent link: https://aithreat.io/cases/chatgpt-dns-runtime-leak/