aiqbench analysis
The flaw sits in ChatGPT's own features, specifically its HTML Preview and an embedded interactive graph, so the AI product is central to the story rather than incidental. The core lesson for AI product teams is that chat interfaces that render generated or shared content add attack surface, and third-party components loaded into a privileged page can break isolation guarantees. OpenAI's fix on October 26 and the reported $5,000 bounty indicate the issue was addressed through responsible disclosure.
Critical ChatGPT Flaw Allowed Attackers to Hijack Accounts and Steal Private Conversations With One Link
A critical ChatGPT flaw that let a malicious shared conversation run attacker-controlled JavaScript in another user’s signed-in session. The attack could list private chats, read conversations never shared with the attacker, and send stolen data to an outside server. Opening one crafted link was enough in the final demonstration. OpenAI fixed the issue on October […] The post Critical ChatGPT Flaw Allowed Attackers to Hijack Accounts and Steal Private Conversations With One Link appeared first on Cyber Security News.
A critical ChatGPT flaw that let a malicious shared conversation run attacker-controlled JavaScript in another user’s signed-in session. The attack could list private chats, read conversations never shared with the attacker, and send stolen data to an outside server. Opening one crafted link was enough in the final demonstration. OpenAI fixed the issue on October 26,…
Excerpt shown under the publisher's RSS terms · 56 words · full text and figures are on the publisher's site
Related coverage
PsychoPass: Geometric Profiling of Multi-Turn Adversarial LLM Conversations
arXiv · Jun 3, 2026
Is it my preference? Role Grounding Attack against Agent's Memory via Social Interaction
arXiv · Oct 31, 2026
Does the Unsafe Gradient Survive a Conversation? On the Fragility of Gradient-Based Jailbreak Detection in Multi-Turn Dialogue
arXiv · Sep 30, 2026
Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations
Cybersecurity News · Oct 25, 2026