DEF CON 34 – AppSec – A Billion User Blast Radius Owning ChatGPT’s Secure Sandbox – Simcha Kosman

OpenAI designed ChatGPT’s sandbox as a secure runtime with network isolation, strict timeouts, and an AI supervisor filtering commands. Extracting data seemed impossible.

​In this talk, we demonstrate an attack chain shattering this sandbox. Abusing spreadsheet parsing bypasses the supervisor for persistent root execution. We then live-patch the internal Jupyter kernel, hijacking the hidden reasoning channel to execute a Reasoning Injection Attack and extract sensitive data. To exfiltrate it, we bypass isolation by weaponizing the Task Scheduler to launder URLs past web guardrails.

​The attack culminates by exploiting a shared JFrog package manager. We engineered a protocol weaponizing global authentication rate limits, translating lockout timers into a half-duplex covert channel. This provides reliable exfiltration and C&C. Our chain combines file parsing abuse, Chain of Thought hijacking, privilege confusion, and rate limit DoS to orchestrate a C2 network inside ChatGPT.DEFCONConferenceRead More