Critical ChatGPT Flaw Allowed Attackers to Hijack Accounts and Steal Private Conversations With One Link
AI-generated summary A critical ChatGPT flaw allowed attackers to run attacker-controlled JavaScript in another user's signed-in session by opening a single crafted link. OpenAI fixed the vulnerability on October 26, 2026, after receiving a technical disclosure from Parameter and awarding a 5,000 dollar bounty.