A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed.

The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.

The trap was an ordinary ChatGPT conversation shared via its public link. It could be sent the same way as any real shared chat: by email, as a chat message, as a support ticket, or as a social post.

The victim did not have to install anything, join a workspace, or sign in through the attacker. In the most reliable version of the attack, they opened the link and clicked ChatGPT's Preview button once. In a later version, Parameter set the page to open Preview on its own, so opening the link was the only step.

Once the link opened, the attacker's code ran inside the victim's signed-in session with the same access as the real ChatGPT site. It listed the victim's recent conversations, opened a private chat that had never been shared with the attacker, and sent a small portion of it to a server controlled by the researchers.

The code called ChatGPT's own signed-in APIs directly, rather than copying what happened to be on the screen. Because it ran with the victim's full web access, its reach was not limited to those chats. "Essentially, we could perform any action on behalf of the victim's ChatGPT account," the researchers wrote .

Source link