ChatGPT Share Link Runs Code, Exposes Private Chats — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Parameter researchers showed that a malicious ChatGPT share link can run an attacker's code in the logged-in session of anyone who opens it, letting the attacker read that user's private conversations.
- OpenAI received the flaw report through its bug bounty program on October 18, when Parameter researchers disclosed the ChatGPT share-link vulnerability through that channel.
Why it matters: For ChatGPT users, the exposure is one click deep: open a shared link and the reported flaw lets an attacker's code run in the logged-in session, exposing private conversations. Parameter's October 18 filing through OpenAI's bug bounty program is the one concrete checkpoint named, leaving OpenAI to answer for the flaw in its own product.
Ask SkimNews
