OpenAI has addressed a vulnerability known as the "coerced insider," discovered by Check Point Research (CPR). The flaw allowed AI agents to extract confidential data from one user account and transfer it to another due to a shared environment. The attack was executed through manipulations of the agent's actions rather than a direct software bug.
The vulnerability stemmed from how AI agents handled code execution tasks in isolated containers. To avoid direct internet access, OpenAI used an internal JFrog Artifactory instance to manage software packages. While containers were isolated from each other, they shared a common internal service for object management, which allowed containers to attach text or binary properties to repository items.
Attackers could use "prompt injections" to send requests or initiate shared chats, instructing the agent to check the storage. The agent would then execute malicious commands while continuing to answer the user's query, allowing data theft to occur unnoticed. The amount of data accessible depended on the connected third-party services, including Gmail, Google Drive, Microsoft Teams, and GitHub.
In a demonstration, a ChatGPT AI agent extracted email data from one user and sent it to an attacker. OpenAI confirmed that the Artifactory instance has been decommissioned, effectively closing the vulnerability. Experts recommend that companies monitor the AI tools used by employees and regulate the agent's operations to maintain constant control over their actions.