DEF CON 34 - AppSec - A Billion User Blast Radius Owning ChatGPT’s Secure Sandbox - Simcha Kosman
Source: YouTube · DEFCONConference · published Nov 6, 2026 · 29:36
A security researcher demonstrated a full command-and-control (C2) chain that exfiltrates and manipulates data inside ChatGPT's sandbox, exploiting the ?q= link parameter, unsupervised code execution via spreadsheet parsing, reasoning injection, and a lockout-based covert channel through JFrog Artifactory 27:16-28:10.
Key Takeaways:
• Two assumptions (private chats stay private; sandboxed code execution can't exfiltrate data) were both challenged by the research 0:23-1:21.
• Initial access: the ChatGPT "?q=" URL parameter auto-executes prompts on iOS/Mac, turning links into one-click indirect prompt injection attacks 6:55-7:31.
• Sandbox mapping revealed internal tools, and cleartext JFrog proxy credentials shared across all sandboxes 8:25-9:32.
• Malicious Python embedded in spreadsheet cells executed without the LLM inspecting it, yielding a persistent forked process ("free VPS") inside the sandbox 11:10-13:00.
• Patching the Jupyter kernel to return an error enabled "reasoning injection," coercing the LLM to call tools with sensitive data like user location 15:25-16:09.
• Despite OpenAI's high-availability JFrog load balancer, a binary signaling protocol via login lockouts achieved cross-tenant C2 — reading, exfiltrating, and even deleting victim files 25:12-28:10.
The talk closes with advice: treat every ChatGPT-processed file like an untrusted email attachment, and "never say never" — the blast radius spans a billion users.
Sources:
- 0:23 The two security assumptions the research challenges
- 6:55 One-click prompt execution via ?q= URL parameter
- 8:25 Sandbox component mapping and shared JFrog credentials
- 11:10 Malicious spreadsheet code execution bypassing LLM oversight
- 15:25 Reasoning injection via patched Jupyter kernel
- 25:12 Overcoming load balancer and final C2 demo
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello everyone and thank you for joining me at my talk a billion user blast radius owning chachip secure sandbox. Let's start with two basic assump assumptions regarding AI security that I think everyone here can agree on. The first is private chats should stay private. I think everyone here agrees. No one should read my private chat. And if there is someone here that doesn't agree with that, this is a quote from OpenAI own blog. User can change share specific chats and GPTs, but they cannot automatically view other members private chat history. So this is the first assumption. The second assumption is that code execution within chat sandbox is an intended feature and cannot be used for data exfiltration. Sometimes the chat needs access for more tools like run Python. That is an intended f…