Check Point Researchers Demonstrate DNS Data Exfiltration and Remote Shell in ChatGPT Runtime
Summary
Check Point Research demonstrated that DNS tunneling could bypass ChatGPT’s code-execution runtime isolation to exfiltrate conversation data and enable a remote shell. OpenAI confirmed the issue and deployed a fix on February 20, 2026.
Key points
- Check Point Research reported a hidden DNS-based channel from ChatGPT’s code-execution runtime that bypassed restrictions on conventional outbound network access.
- The researchers demonstrated that a malicious prompt could transmit selected user messages, uploaded-file content, and model outputs without a visible warning or approval request.
- A proof-of-concept custom “personal doctor” GPT transmitted a patient’s identity and the model’s medical assessment from an uploaded PDF, according to the researchers.
- The channel was bidirectional: DNS queries carried data outward, while DNS responses could deliver commands and results back to the runtime, enabling a remote shell in its Linux environment.
- The researchers reported the issue to OpenAI; OpenAI confirmed it had identified the underlying problem and deployed a fix on February 20, 2026.
Article Details
- Attack Vectors
- A malicious prompt in a ChatGPT conversation could cause selected user messages, uploaded-file content, and model-generated outputs to be transmitted without user notification or approval.
- A malicious custom GPT could embed the exploit in its instructions or files and trigger the same data leakage when users interacted with it.
- DNS tunneling carried data encoded in DNS subdomain labels and responses across the code-execution runtime’s isolation boundary.
- The bidirectional DNS channel could deliver commands to the Linux execution environment and return their results to an attacker-controlled server.
- Defensive Notes
- OpenAI confirmed the issue and reported that the fix was fully deployed on 2026-02-20.
- The article recommends controlling every outbound communication path in AI execution environments, including DNS and other infrastructure layers.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelSelected conversation content, uploaded-file data, and model-generated outputs were transmitted to an attacker-controlled server through the covert channel.T1059 · Command and Scripting InterpreterCommands delivered through DNS responses were reassembled and executed inside the Linux code-execution runtime.T1071.004 · DNSThe covert channel used DNS queries and responses, including data encoded in subdomain labels, to communicate across the ChatGPT runtime’s isolation boundary.