DEF CON 34 - AppSec - A Billion User Blast Radius Owning ChatGPT’s Secure Sandbox - Simcha Kosman
MentionsOpenAI
Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.
OpenAI designed ChatGPT's sandbox as a secure runtime with network isolation, strict timeouts, and an AI supervisor filtering commands. Extracting data seemed impossible. In this talk, we demonstrate an attack chain shattering this sandbox. Abusing spreadsheet parsing bypasses the supervisor for persistent root execution. We then live-patch the internal Jupyter kernel, hijacking the hidden reasoning channel to execute a Reasoning Injection Attack and extract sensitive data. To exfiltrate it, we bypass isolation by weaponizing the Task Scheduler to launder URLs past web guardrails.
Description from DEF CON.
Explained
The technology and terms in this story. Learn more
