{
 "public_id": "AIR-2026-0191",
 "incident_id": "2026-08-defcon34-chatgpt-sandbox-escape",
 "date_disclosed": "2026-08-09",
 "date_occurred": null,
 "title": "A Billion-User Blast Radius: owning ChatGPT's secure sandbox (DEF CON 34)",
 "class": "research_demo",
 "attack_surface": "consumer_chatbot",
 "initial_vector": "sandbox_escape",
 "agent_capability_abused": [
  "code_interpreter",
  "code_execution"
 ],
 "target_product": "ChatGPT (code-execution sandbox)",
 "target_vendor": "OpenAI",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "sandbox_escape",
  "code_execution"
 ],
 "blast_radius": "framed by the speaker as billion-user scale",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "conference_demo",
   "sandbox_escape"
  ]
 },
 "defense_present": "OpenAI's ChatGPT execution sandbox",
 "defense_bypassed": true,
 "fix_shipped": null,
 "primary_sources": [
  "https://aivillage.org/events/defcon-34/"
 ],
 "verified_quote": "A Billion-User Blast Radius: Owning ChatGPT's Secure Sandbox",
 "confidence": "medium",
 "notes": "Simcha Kosman, DEF CON 34 AI Village stage talk, Sunday 9 Aug 2026 10:00-10:30. Only the AI Village schedule page is available as a source; the talk abstract, slides and any vendor response are not publicly available, so technical detail and fix status are unknown. Black Hat USA 2026 coverage separately reports sandbox escapes demonstrated against ChatGPT, Cloudflare workerd and Claude Code.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Remote Code Execution & Sandbox Escape",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "a sandbox escape in ChatGPT's code-interpreter infrastructure",
 "vector_family": "other",
 "vector_detail": "sandbox_escape",
 "guardrail_kind": [
  "sandbox_isolation"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "unknown",
 "model_provider": "openai",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [],
 "eai_reason": "subcategory: Remote Code Execution & Sandbox Escape",
 "asi_curated": [
  "ASI05"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated",
 "asi_reason": "curated: ASI05",
 "submitted_by": "EAI Internal"
}