ChatGPT Share Link Can Run Code in Logged-In Sessions — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Parameter researchers showed that a malicious ChatGPT share link could run an attacker’s code.
- The logged-in session of anyone who opened the link was exposed to the attacker’s code.
- The flaw allowed the attacker to read the private conversations belonging to the person whose session ran the code.
- OpenAI received the flaw report through its bug bounty program on October 18.
Why it matters: ChatGPT users who open shared links stand to lose private-conversation confidentiality because attacker code can enter their logged-in sessions, while attackers gain access to those chats. The disclosure reached OpenAI through its bug bounty program on October 18, tying a named reporting date to the session-level execution and private-data exposure.
Ask SkimNews
