ChatGPT Flaw Let a Shared Chat Link Expose User Histories
Researchers at Parameter found a ChatGPT vulnerability in which a shared-conversation link could run malicious code and reach a user's chat history. OpenAI has fixed it.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesA vulnerability in ChatGPT allowed an ordinary link to a shared conversation to be turned into a tool for stealing private user data. Researchers at the firm Parameter discovered the flaw, which OpenAI has since fixed.
How the attack worked
According to the researchers, the bug made it possible to run malicious code inside the active session of a logged-in user. Once the code was running, an attacker could gain access to that person's conversation history.
The entry point was deliberately mundane: a link to a shared chat, the kind of URL people routinely send to colleagues or post online. That is what made the weakness worrying, since opening such a link is something most users would not think twice about.
Why it matters
ChatGPT histories often contain sensitive material, from personal questions and work documents to business plans and code. Access to a whole history could therefore expose far more than a single exchange.
OpenAI has patched the issue, so the vulnerability no longer works in its original form. The researchers stress, however, that the potential consequences were serious.
The case is a reminder that features designed for convenience, such as sharing conversations, widen the attack surface of AI assistants. Users who keep sensitive information in their chats may want to review what they store there and be cautious with links from unknown sources.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →Sequoia Capital raises €8.9 billion in new funds, closes London office
ChatGPT Helps Reddit User Find Lost Bose Earbud in Gravel
AI Smart Glasses Help Low-Vision Users Identify Objects
Soter Insure Adds SC Ventures and SBI Group to Series B Round
More in: Security
See all →
Arara Breach: Moss Burger, Workman, IIJmio Confirm Data Leaks
OpenAI AI Agents Find 948 Linux Kernel Root Exploits
Attackers target Zyxel GS1900 switches; security patches available
