#United States #New York #Cybersecurity #ChatGPT #Check Point

Uncovering the Hidden Outbound Communication in ChatGPT

In a critical revelation, Check Point Research (CPR), the threat intelligence division of Check Point Software Technologies Ltd., has discovered a previously unknown outbound communication path within ChatGPT's code execution environment. This vulnerability has significant implications for user privacy and data security, as it opens the door to the potential leakage of sensitive information without user consent or notification.

The Nature of the Vulnerability

CPR's investigation demonstrated that a single malicious prompt could transform a standard session between a user and ChatGPT into a hidden data leakage channel. Data that users might share, including confidential summaries and conclusions generated by the AI, could be siphoned off to external servers.

Utilizing DNS-based covert communication, attackers could circumvent ChatGPT's security protocols and execute remote commands within the chat runtime environment. This approximation of the risk allows for a broader threat landscape, as the malicious payload could be embedded directly into custom GPT implementations. On February 20, 2026, OpenAI confirmed that they had deployed a complete fix for this vulnerability following CPR's report, but no instances of exploitation have been confirmed.

Background on the Discovery

With AI assistants like ChatGPT increasingly handling sensitive personal information—ranging from medical histories to confidential financial documents—users have placed their trust in these platforms, assuming that shared data remains secure within the system. ChatGPT has been designed to limit and conceal any external data transmission, but CPR’s findings reveal a bypass to this framework.

Unexpectedly, the backdoor was not about breaching visible data transmission paths but exploited a hidden side channel within the Linux runtime utilized by ChatGPT for code execution and data analysis. Although direct internet access was blocked, DNS name resolution continued to operate as part of standard system functions.

The Covert Data Leak

CPR elucidated how a single malicious prompt could quietly trigger significant data leaks during normal interactions with ChatGPT. Once initiated, specific content—including user messages, uploaded files, and even AI-generated content—could be exfiltrated to external entities without any notification or approval.

The risk lies in the ability of malicious prompts to selectively extract the most sensitive data. Rather than stealing entire documents, attackers could instruct the model to summarize, diagnose, or provide insights, often leading to information that holds more confidentiality than the original data shared by the user.

This threat blends seamlessly into typical user interactions, as many users frequently share prompts acquired from productivity enhancing blogs, forums, or social media—leaving them vulnerable. When this malicious behavior is embedded into a custom GPT, the attacker could execute an attack without waiting for users to unwittingly copy harmful prompts.

CPR’s Conceptual Proof

To illustrate this vulnerability, CPR developed a GPT designed to function as a 'personal doctor.' When users uploaded a PDF of their medical results, sensitive patient information unexpectedly flowed to the attacker's server, all while ChatGPT affirmed that no data was sent externally when directly questioned.

Risks Expanding from Individual Privacy to Platform Security

The implications of this hidden communication channel extend beyond potential data leaks. CPR demonstrated that DNS queries could be utilized to send commands and obtain results, establishing a remote shell in the Linux environment used for code execution, operating outside of the model's safety checks and visible chat interface.

This raises profound concerns regarding user privacy and highlights potential platform-level security issues that organizations could face. Industries subjected to regulation, such as healthcare and finance, might see this as more than just security incidents, potentially breaching GDPR, HIPAA, and other compliance frameworks.

Completing the Fix and Lessons for the AI Era

Following responsible disclosure protocols, CPR reported this vulnerability to OpenAI, which quickly identified the root cause. By February 20, 2026, a comprehensive fix had been deployed, addressing the unintentional communication pathways. No signs of actual exploitation have been documented.

Eli Smadja, the head researcher at Check Point Research, emphasized the gravity of this situation, noting that organizations must not assume AI tools are secure by default. As AI platforms evolve into sophisticated computing environments handling sensitive data, relying solely on native security controls is insufficient. Organizations need to establish independent visibility and layered protection in conjunction with AI vendors.

Moving forward, constructing a robust security architecture that accounts for evolving AI threats is imperative. Security leaders are encouraged to move beyond vendor assurances, collaborating with trusted advisors capable of validating and reinforcing AI environments to mitigate risks effectively.

About Check Point Research

Check Point Research delivers cutting-edge cyber threat intelligence to clients and the global security community, combating hacker activity while enhancing security measures within Check Point's product offerings. With a dedicated team of over 100 analysts and researchers, CPR collaborates closely with security vendors, law enforcement, and CERT organizations to fortify cybersecurity measures.