ChatGPT
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by GBHackersChained flaw in ChatGPT public share links exposed private conversations
- Vulnerability reported by Cyber Security NewsCritical ChatGPT flaw let one malicious link access private chats; OpenAI has fixed it
- Malware reported by Security AffairsSecurity Affairs newsletters flag malicious Claude Code extension, Trezor implant warning and AI-driven attacks
- Activity reported by GBHackersAttackers impersonate ChatGPT, Claude and Perplexity bots to hunt for exposed credentials
Recent news
Chained flaw in ChatGPT public share links exposed private conversations
Researchers chained several flaws so that a public ChatGPT share link ran attacker-controlled JavaScript inside the victim's authenticated session, putting private conversations at risk. OpenAI fixed the issue on October 26 and classified it as P1, and the Parameter researchers' write-up says it earned a $5,000 bounty.
Vendor article argues penetration testing firms should run AI in-house to protect client data
The article, published as promotional content for PentestPad, says penetration testing firms face pressure to adopt AI and that staff often use it without approval. It argues that uploading client scope documents, vulnerabilities and credentials to cloud AI providers risks breaching confidentiality and compliance obligations, and recommends self-hosted models. PentestPad is presented as a reporting platform that can run on self-hosted or air-gapped infrastructure and exposes its data to agents through MCP.
Critical ChatGPT flaw let one malicious link access private chats; OpenAI has fixed it
A critical ChatGPT vulnerability allowed attacker-controlled JavaScript to run in a victim's signed-in session via a malicious shared conversation. It could list and read private conversations and exfiltrate data to an external server, with a single link sufficing in the demonstration. OpenAI fixed it on 26 October 2026 after a report from Parameter, which received a $5,000 bounty.
Security Affairs newsletters flag malicious Claude Code extension, Trezor implant warning and AI-driven attacks
The Security Affairs AI-cybersecurity and malware newsletters collect recent reporting on AI-enabled attacks, Android spyware such as uCreator, and a Magento skimming campaign affecting 953 stores. They also flag a malicious Anthropic.claude-code build (2.1.313) found in the Cursor Extension Marketplace, a Trezor warning about a suspected crypto-theft implant, and a Hugging Face malware campaign that returned after a takedown.
Attackers impersonate ChatGPT, Claude and Perplexity bots to hunt for exposed credentials
A single actor reportedly rotated through about 32 bot identities, including ChatGPT, Claude and Perplexity, to scan enterprise websites for exposed passwords, API keys and cloud credentials. Cequence tracked the campaign across multiple industries, and on one October day it reached 48% of the organisations it protects that received any such traffic. Teams should review bot management rules and check public-facing sites for leaked secrets.
Journalists report surge of AI-generated tech support spam after ChatGPT referrals
A 404 Media journalist says that since publishing an article about ChatGPT acting as tech support, he has received a rising number of AI-generated emails from people asking him to fix their technical problems. He believes the trend affects journalists broadly, as ChatGPT chats reportedly directed users to contact multiple journalists, lawyers and academic researchers.