Malicious ChatGPT Share Link Can Execute Attacker Code in User Sessions
Original headline: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
Researchers at the security firm Parameter discovered that a malicious ChatGPT share link can execute attacker‑controlled code in the logged‑in session of anyone who opens it, allowing the attacker to read private conversations. The flaw was reported to OpenAI through its bug bounty program on October 18, and OpenAI classified it as a P1 vulnerability and deployed a fix eight days later.
The issue highlights the urgent need for stronger session security in widely used AI chat services.
Research angleHow does the risk of session hijacking via shared AI links affect users' security compliance intentions? — Protection Motivation Theory
Turn this security issue into a research project
HJITM works with researchers from study design through surveys, analysis and submission to international journals in generative AI and technology management. Bring us your research question.
This item is an AI-generated summary of reporting by The Hacker News. Please check the original article for accuracy. Copyright in the original article belongs to The Hacker News.