AI & Machine Learning
Oct 31, 2026
Research Team Exploits ChatGPT Vulnerability to Access User Accounts
Oct 31, 2026
AI Summary
A research team discovered a vulnerability in ChatGPT that allowed them to take control of user accounts by sending a malicious link. The issue was fixed by OpenAI on October 26, 2026, after confirming that attackers could access private conversations and data without any user intervention beyond opening the link.
- The research team bypassed ChatGPT's security measures by exploiting a combination of features, including a public share link and an HTML Preview.
- By sending a specially crafted link, an attacker could execute JavaScript in the victim's signed-in session, allowing access to private conversations and the ability to send data to an external server.
- The vulnerability was confirmed to allow enumeration of the victim's conversation list and retrieval of private message content.
- OpenAI classified the issue as P1 and implemented a fix on October 26, 2026, which involved changes to the Content Security Policy and blocking cross-frame messages.
- The exploit relied on a combination of features that appeared harmless individually but created a significant security risk when used together.
chatgptopenaiaccount securityai ethicscybersecurity