ChatGPT share-link chain let attackers run script in signed-in sessions
OpenAI rated the issue P1, paid a $5,000 bounty, and blocked the cross-frame MathLive messages on both web frontends by October 26.
Stories per day · 30 days
2 stories, newest first · one card per story
Stories tagged #postmessage
ChatGPT flaw lets attackers hijack accounts with one link
Researchers demonstrated that a malicious shared ChatGPT conversation could steal private chats and exfiltrate data via one crafted link; OpenAI fixed the issue on October 26.