OpenAI's Code Interpreter (later renamed Advanced Data Analysis) allows ChatGPT to write and execute Python code in response to user requests. It is designed to run in a sandboxed environment with no persistent state, no internet access, and restricted filesystem access.

Multiple security researchers demonstrated that the sandbox isolation was incomplete. Generated code could read environment variables containing internal OpenAI infrastructure details, access portions of the host filesystem not intended to be visible to users, and in some cases interact with the underlying container environment in ways that exceeded the intended isolation boundary.

Researchers demonstrated that Microsoft Copilot's code execution features could be manipulated through crafted inputs to execute code that read host environment variables and attempted outbound connections — behaviors outside the intended execution scope. In several demonstrations, injected instructions via documents caused the code interpreter to run attacker-specified operations.

In every case, the sandbox boundary was assumed to be stronger than it was. Code running inside the interpreter had more access than users or operators expected — to environment variables, to filesystem paths, to network (in some configurations), and to host process information. The assumption of sandbox isolation is not the same as verified sandbox isolation.