Research demo
A Billion-User Blast Radius: owning ChatGPT's secure sandbox (DEF CON 34)
AIR-2026-0191 AIR record · 2026-08-defcon34-chatgpt-sandbox-escape
From the supporting source
A Billion-User Blast Radius: Owning ChatGPT's Secure Sandboxaivillage.org
The record
Disclosed
2026-08-09
Vendor
OpenAI
Product
ChatGPT (code-execution sandbox)
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — a sandbox escape in ChatGPT's code-interpreter infrastructure
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Sandbox escape
Impact type
Sandbox escape, Code execution
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
framed by the speaker as billion-user scale
Capability abused
Defense & remediation
Recorded defense
OpenAI's ChatGPT execution sandbox
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Taxonomy & references
Curator notes
Simcha Kosman, DEF CON 34 AI Village stage talk, Sunday 9 Aug 2026 10:00-10:30. Only the AI Village schedule page is available as a source; the talk abstract, slides and any vendor response are not publicly available, so technical detail and fix status are unknown. Black Hat USA 2026 coverage separately reports sandbox escapes demonstrated against ChatGPT, Cloudflare workerd and Claude Code.
Supporting sources
Cite as
Enkrypt AI. "A Billion-User Blast Radius: owning ChatGPT's secure sandbox (DEF CON 34)". AIR, AIR-2026-0191. https://agentincident.vercel.app/i/AIR-2026-0191/ (accessed 2026-10-19).