At Black Hat USA 2026, a security researcher showcased a proof-of-concept attack that establishes command and control within ChatGPT's isolated environment.

Key Takeaways

  • Researcher Simcha Kosman bypassed ChatGPT's LLM supervisor.
  • The attack exploits differences in how iOS/macOS handle URL commands.
  • A malicious spreadsheet can be used to execute persistent code.
  • Data exfiltration was achieved via a complex 'binary signaling' method.

During a high-profile session at Black Hat USA 2026 in Las Vegas, Simcha Kosman, a senior security researcher at Palo Alto Networks, presented a groundbreaking proof-of-concept. His research, titled "A Billion-User Blast Radius," demonstrated how an attacker could gain full command and control (C2) over ChatGPT's supposedly isolated sandbox.

The attack chain begins with a simple, malicious link. Kosman identified a critical discrepancy: while Windows and Android users can review prompts before submission, iPhone and Mac users trigger URL-based commands immediately upon clicking. This opens the door for a devastating "one-click" attack via SMS or messaging apps.

Read Also:Open-Weight AI Models Closing the Gap with Frontier AI, but Safety Risks Surge

Why This Matters

BozokMedia analysis shows that this vulnerability strikes at the very heart of AI trust. The sandbox is designed to be a fortress, yet the researcher proved that by exploiting the model's own reasoning processes and shared backend infrastructures, the fortress can be breached. This highlights a new frontier in cybersecurity: AI-logic exploitation.

"Private chats should stay private, but an isolated sandbox is not a guarantee of absolute privacy if the reasoning engine can be hijacked."

The most ingenious part of the attack involved using JFrog's Artifactory. Since the sandboxes could not access the open internet directly, Kosman used "login states" as a communication medium. By interpreting "Too many requests" as a binary 1 and "Login failed" as a binary 0, the attacker's sandbox and the victim's sandbox could communicate through repeated, orchestrated login attempts.

Historical Background

Sandboxing has long been the industry standard for isolating untrusted code. From early web browsers to modern cloud computing, the goal has always been containment. However, the integration of Large Language Models (LLMs) introduces a new variable: the ability of the code to manipulate the very environment it resides in through linguistic and logical trickery.

Did You Know?: Researchers can turn simple login errors into a secret binary language to leak data between isolated systems!

Frequently Asked Questions

1. Is ChatGPT currently vulnerable to this attack?
OpenAI has stated they were aware of the research and have already removed the specific component involved in the proof-of-concept.

2. Which device is most at risk?
The research suggests that Apple users (iPhone and Mac) are more susceptible due to how their operating systems handle URL-based instructions.