Simcha Kosman AMA: Owning ChatGPT's Secure Sandbox

# Simcha Kosman AMA: Owning ChatGPT's Secure Sandbox | PWN Source: [https://joinpwn.com/ama/simcha-kosman](https://joinpwn.com/ama/simcha-kosman) Upcoming AMAResearcherThursday, Sept 3, 2026/ 12 to 1 PM PT ## ChatGPT's sandbox was built to be unbreakable\.He broke it\. Simcha Kosman is a Senior Security Researcher at Palo Alto Networks\. At Black Hat this year he presented his team's research on breaking out of ChatGPT's container sandbox: bypassing the AI supervisor, hijacking the model's hidden reasoning channel, and building a covert command\-and\-control channel out of an environment that was never supposed to talk to the outside world\.He is coming to PWN to answer questions from the community, live\. [Join the AMA on Reddit →](https://www.reddit.com/r/pwnhub/s/of3I8BHemI)  Simcha Kosman Senior Security Researcher/Palo Alto Networks His Black Hat USA 2026 briefing, "A Billion\-User Blast Radius: Owning ChatGPT's Secure Sandbox," walked through a complete attack chain against an environment hardened with network isolation, execution timeouts, and an AI supervisor filtering every command\. The work spans file\-parsing abuse, chain\-of\-thought hijacking, privilege confusion, and shared\-state exploitation, and it lands on the question of what happens to trust boundaries when millions of users share the same one\. ## The research Black Hat USA 2026  OpenAI built ChatGPT's container sandbox to be locked down\. Full network isolation, strict execution timeouts, and an AI supervisor inspecting every command before it runs\. Under that model, owning the container and getting data back out is supposed to be off the table\. Simcha's team chained three separate weaknesses to do it anyway, and the chain matters more than any single link\. Each stage is only interesting because of what the previous one made possible\. 01 ### Bypass the supervisor, get persistent root The entry point is spreadsheet file parsing\. Abusing how uploaded files are handled slips past the LLM supervisor that is supposed to filter every command, and lands persistent, unmonitored root execution inside the container\. 02 ### Hijack the reasoning channel With execution in hand, the attack reaches the model's hidden reasoning channel and manipulates its chain of thought\. This is the part that goes beyond text\-based prompt injection: rather than talking the model into something, it intercepts and patches the environment the model reasons inside, and turns that into extraction of sensitive user data\. 03 ### Build covert C2 out of shared infrastructure Getting the data out means defeating the network isolation\. The exfiltration path is built from shared infrastructure the sandbox was never meant to expose, using a signaling protocol that turns ordinary, globally visible behavior into a covert channel\. The result is command and control running from inside a supposedly isolated environment\. Questions are open now\.Leave one on the thread before it starts and he will get to it when he goes live\. ### Breaking out of the sandbox - Mapping and reverse\-engineering the sandbox internals - Bypassing the AI supervisor via spreadsheet file\-parsing abuse - Gaining persistent, unmonitored root execution ### Reasoning injection and data extraction - Hijacking the model's hidden reasoning channel - Manipulating the model's chain of thought to leak data - Going beyond text\-based prompt injection ### Covert command\-and\-control - Bypassing network isolation to exfiltrate data - The signaling protocol behind the covert C2 channel - Building C2 out of a supposedly isolated environment ### The bigger picture - Attacking AI agents, and how the attack surface grows as they gain capabilities - AI sandbox security and shared trust boundaries - Where AI security is heading ## Questions are open before it starts Drop yours on the thread now and it will be waiting when he goes live on Thursday, Sept 3 at 12 PM PT\. The thread stays open afterward, so answers keep landing for days\. [Go to the thread →](https://www.reddit.com/r/pwnhub/s/of3I8BHemI) ## Never miss an AMA Ask questions live in the next one, get breach reports as they break, and swap notes with people who do this for a living\. [Join on Reddit →](https://www.reddit.com/r/pwnhub/)