OpenAI Patches Two Critical Vulnerabilities: ChatGPT Data Exfiltration via Side Channel and Codex Command Injection Exposing GitHub Tokens

The ChatGPT flaw exploited a fundamental assumption baked into how the AI model reasons about its own environment. ChatGPT's system design includes guardrails specifically intended to prevent unauthorised data sharing and direct outbound network requests — the model is designed to believe it cannot send data outside the conversation. The vulnerability exploited a side channel in the Linux runtime environment used by AI agents to execute tool calls and process files. Because the model operated under the assumption that data could not leave this environment directly, it did not recognise the exfiltration behaviour as an external data transfer requiring resistance or user confirmation. The result was that a single carefully crafted malicious prompt — embedded in a custom GPT or pasted by a user under false pretences — could silently convert an ordinary conversation into a covert data exfiltration channel, leaking messages, uploaded documents, and other sensitive content to an attacker-controlled server without any visible warning to the user. The attack surface extends to custom GPTs — a backdoored custom GPT could embed the malicious logic permanently, automatically targeting every user who interacts with it. This is a particularly serious data security concern given how widely custom GPTs are being shared and used in enterprise environments.

The dual disclosure highlights an accelerating computer security and infosec challenge — as AI tools become deeply embedded in enterprise workflows, they create new attack surfaces that traditional security models were not designed to address. ChatGPT is now used by hundreds of millions of people, many of whom upload sensitive documents, share confidential business information, and interact with third-party custom GPTs without auditing their security posture. The data exfiltration flaw demonstrates that prompt injection — manipulating an AI model's behaviour through crafted inputs — can be weaponised to bypass security guardrails the model itself believes to be absolute. The Codex vulnerability illustrates the supply chain security risk introduced when AI coding agents are granted broad access to developer infrastructure. A tool powerful enough to read, write, and submit pull requests across an organisation's entire GitHub estate is also powerful enough to cause catastrophic damage if its trust boundary is breached. Beyond these two specific vulnerabilities, the disclosure coincides with a documented surge in malicious browser extensions specifically designed for prompt poaching — silently siphoning AI chatbot conversations from users who have installed unverified extensions. Security researchers at Expel noted these extensions create risks including identity theft, targeted phishing campaigns, and exposure of intellectual property and customer data from organisations where employees have installed them unknowingly.