TechCapsules

AI-summarised brief · reviewed before publication

Researchers at Parameter discovered a vulnerability in ChatGPT’s public‑share feature that allowed an attacker to execute code within a victim’s logged‑in session. By sending a shared chat link, the attacker could run malicious scripts that accessed the victim’s private conversations and transmitted them to an external server. OpenAI reported the flaw through its bug‑bounty program on October 18, fixed it within eight days, and rated it P1, the highest severity. The exploit leveraged the Preview feature, an interactive graph, and a YouTube‑hosted script to bypass content‑security policies. The fix disabled the vulnerable message handling in both web frontend versions.