A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.
Researchers at security firm Parameter discovered a vulnerability in ChatGPT that could allow an attacker to run malicious code in the session of anyone who opens a shared ChatGPT link. This could enable the attacker to read the victim's private conversations. The flaw was reported through OpenAI's bug bounty program on October 18 and fixed eight days later, rated as P1, the most severe category.
The attack was carried out through an ordinary ChatGPT conversation shared via a public link, which could be sent through various means. The victim did not need to install anything, join a workspace, or sign in through the attacker. Once the link was opened, the attacker's code ran within the victim's signed-in session with the same access as the real ChatGPT site.
It could list recent conversations, open a private chat, and send a portion of it to a server controlled by the researchers. The attack relied on two design choices: the Preview feature, which could load any code into a separate web page, and a listener in the shared chat that accepted unverified messages containing raw HTML. OpenAI acknowledged the vulnerability, raised its severity rating, and released a fix, blocking the attack within two versions of ChatGPT's web frontend.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
