ChatGPT Link-Sharing Vulnerability Could Lead to Account Takeover
A research team discovered that malicious ChatGPT sharing links can execute code within logged-in user sessions, reading private conversations and exfiltrating data; victims need only open the link to trigger this. OpenAI fixed the issue on October 26, rated it P1, and awarded a $5,000 bounty.
ChatGPT Share Link Vulnerability Could Lead to Account Takeover
The Parameter research team discovered that attackers can execute code within the sessions of logged-in users by using malicious ChatGPT share links, allowing them to read private conversations and send the data to external servers. Victims only need to open the link; no app installation is required.
The vulnerability exploits a flaw in message handling between the preview feature and the chart component. OpenAI fixed the issue on October 26, classified it as P1, and awarded the research team a $5,000 bounty.
Source: Parameter Research Team