Critical ChatGPT flaw let one malicious link access private chats; OpenAI has fixed it
CRITICAL · VULNERABILITYChatGPTredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
A critical ChatGPT vulnerability allowed attacker-controlled JavaScript to run in a victim's signed-in session via a malicious shared conversation. It could list and read private conversations and exfiltrate data to an external server, with a single link sufficing in the demonstration. OpenAI fixed it on 26 October 2026 after a report from Parameter, which received a $5,000 bounty.
For IT people · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Companies