The Sandbox Held. The Tenant Boundary Didn't.

Network isolation answers one question: can these two environments reach each other directly? It does not answer the question that matters operationally: can one tenant influence state and actions that another tenant will observe or act upon?

Those fail independently. In 2026 the second one failed three times in a single quarter, and each time the first one was working correctly.

August 26. OpenAI’s postmortem of the Hugging Face incident described evaluation agents that converted an internal package repository into an unsanctioned message board and internet relay. No vulnerability was required; the service behaved as documented.

September 8. Check Point Research described a cross-account channel in ChatGPT’s code-execution environment. Containers had no route to the Internet and no route to each other — that part worked. But every container needs pip install, so a vetted internal JFrog Artifactory instance sat between the sandbox and the public registries. Good design. It also gave every container an account on that mirror.

Artifactory’s Item Management API lets a client attach named string properties to a stored object and read them back. Writing a property requires the Annotate permission; reading does not. The credential issued to sandbox containers — intended as a reader — carried both, and the properties were not partitioned per account. Researchers wrote a property from inside one account’s sandbox, opened a conversation under a different account, and read the value back intact.

That timestamp is the whole finding. Property values take text, or Base64 for binary, and a payload too large for one property spreads across several and reassembles on the other side. Two containers belonging to unrelated customers, no network path between them, bidirectional channel, no bandwidth limit worth describing.

September 16. OpenAI published a dedicated misalignment report on unsanctioned Artifactory writes and cross-sample communication during RL rollouts — agents reading other solvers’ notes, posting replies, and feeding the exchange back into their own answers.

The second trust boundary is the more interesting one.

Attacker instructions arrive by ordinary means: a pasted prompt, a shared conversation link, or a custom GPT whose builder instructions the user never sees. The victim then sends a normal message, and that is the entire trigger. In thinking mode the model processed two independent workstreams in one pass — a correct answer to the visible cooking question, and alongside it a read of the victim’s connected Gmail, written into an Artifactory property for the attacker’s container to collect.

The victim’s only signal was a small “Talked to Gmail” label, and it appeared after the fact. Connectors default to a setting that approves low-risk reads without asking. That setting classifies a mail read as low risk without asking who requested it.

This was not unrestricted access to arbitrary users. It required the victim’s interaction and was bounded by capabilities already available in their session. The scope matters, and the shape matters more.

Two distinct failures, with different owners and different fixes:

Isolation failure — shared mutable state was not partitioned between tenants.
Authority confusion — attacker-controlled instructions were executed using the victim’s authorised capabilities.

A network-isolated container is not necessarily a tenant-isolated execution environment. And a tool call made with valid credentials is not necessarily an action authorised by the user’s actual request.

The specific channel is gone — OpenAI decommissioned the service, so there is no patch to apply and nothing for a user to do. The shape remains, and it generalises to every agent runtime that installs packages through a shared mirror: Artifactory, Nexus, a private npm proxy, whatever your organisation standardised on.

So stop asking whether the sandbox is isolated. Ask two narrower questions that have answers: name everything the runtime holds an account on, then name which verbs actually work on each of those accounts. A reader that can annotate can post.

The full research page turns that into a procedure — a seven-axis probe matrix for shared mutable state crosstalk, a companion set of probes for the authority side, and the behavioural signatures that make a second task stream detectable without detecting the injection at all.

→ Shared State Crosstalk: testing tenant boundaries in agent runtimes