{
  "id": 17453671,
  "title": "Researchers are paid $5K for reporting a bug to OpenAI that would let attackers run code in logged-in sessions of all who opened the hacker's ChatGPT share link (Swati Khandelwal/The Hacker News)",
  "url": "https://urgent.news/2026/10/31/researchers-are-paid-5k-for-reporting-a-bug-to-openai-that-would-let",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-31T19:01:11.000Z",
  "source": {
    "name": "Techmeme",
    "slug": "techmeme",
    "url": "https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html"
  },
  "original_language": "en",
  "account": "Researchers discovered a security flaw that allowed attackers to execute code within logged-in ChatGPT sessions of all users who opened a malicious link, as reported by Parameter security firm. They discovered this vulnerability using OpenAI's bug bounty program on October 18. The flaw, rated P1, the most serious category, enabled attackers to access victims' private conversations, list recent chats, and send snippets of conversations to their controlled server. The attack was executed through a normal ChatGPT shared link, which could be sent via email, chat, support ticket, or social post. Victims did not need to install anything or sign in separately. To carry out the attack, victims only needed to open the link and click ChatGPT's Preview button. The attacker's code then ran within the victim's signed-in session, gaining access to their account's full web capabilities. The issue stemmed from three design choices: ChatGPT's Preview feature, which could convert HTML into web pages and run code in a sandboxed environment; the interactive graph within the shared chat that loaded MathLive, a math library into the main ChatGPT page; and the acceptance of messages between browser frames, which ignored the recipient verification, allowing the attacker's HTML to be embedded in the trusted main page. OpenAI acknowledged the issue on October 26 and patched the vulnerability. Parameter received a total compensation of $5,000 from OpenAI for the report.",
  "summary": "A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it …",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 6,
    "also_reported_by": [
      {
        "outlet": "CNA - Business",
        "title": "OpenAI to limit weapons information for teens on ChatGPT in violence-prevention push",
        "url": "https://urgent.news/2026/10/30/openai-to-limit-weapons-information-for-teens-on-chatgpt-in-violence",
        "published": "2026-10-30T17:30:08.000Z"
      },
      {
        "outlet": "Android Authority",
        "title": "OpenAI caves to backlash and reverses course on reducing ChatGPT usage limits",
        "url": "https://urgent.news/2026/10/30/openai-caves-to-backlash-and-reverses-course-on-reducing-chatgpt",
        "published": "2026-10-30T17:38:32.000Z"
      },
      {
        "outlet": "Techmeme",
        "title": "OpenAI tightens limits on the weapons-related information that ChatGPT provides teens, even when a question appears harmless, as part of new safeguards (Reuters)",
        "url": "https://urgent.news/2026/10/30/openai-tightens-limits-on-the-weapons-related-information-that",
        "published": "2026-10-30T20:55:37.000Z"
      },
      {
        "outlet": "The Hindu - Sci-Tech",
        "title": "OpenAI to limit weapons information for teens on ChatGPT in violence-prevention push",
        "url": "https://urgent.news/2026/10/31/openai-to-limit-weapons-information-for-teens-on-chatgpt-in-violence",
        "published": "2026-10-31T05:20:22.000Z"
      },
      {
        "outlet": "Malay Mail",
        "title": "OpenAI limits weapons information for teens using ChatGPT",
        "url": "https://urgent.news/2026/10/31/openai-limits-weapons-information-for-teens-using-chatgpt",
        "published": "2026-10-31T08:49:17.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}