Critical ChatGPT Vulnerability Allowed Attackers to Read Private Chats via Shared Links

A significant vulnerability in ChatGPT's shared link functionality allowed attackers to run malicious code within a user's logged-in session, potentially enabling them to read private conversations. Researchers at security firm Parameter discovered the flaw and reported it to OpenAI on October 18, which was subsequently fixed eight days later and rated as a P1 (most serious) category issue. The attack could be executed by simply opening a malicious shared ChatGPT link, with later versions of the exploit requiring only the link to be opened, bypassing the need for a 'Preview' click.