Researchers show how a ChatGPT share link could have taken over an account; OpenAI fixed it on 26 October

Security firm Parameter Labs published a write-up of a flaw in ChatGPT's HTML Preview and graph features. A public share containing the attack could run code inside the signed-in session of whoever opened the link, and the team says it read the list of a victim's conversations and the content of a private one. The only action needed by the victim was opening the link. OpenAI fixed it on 26 October and classed it as P1.

• Be wary of ChatGPT share links from people or pages you do not know, and open them only when you trust the sender, the same way you treat any link in an email.
• Look at what is saved in your ChatGPT chats and delete anything you would not want read, such as passwords, ID numbers or client details, because the account holds everything you have typed.

Source: Parameter Labs. This is our short summary of their reporting. The paragraphs marked "Our read" and the things to do are SeedFoundry's opinion. The summary is drafted with AI tools. Image: Parameter Labs, from its own announcement. How we source and credit