Today for AI
HOT RADAR
toolsHEAT 15.1°

AI CURATED HOT STORY · 10/31/2026

Critical ChatGPT Flaw Allows Account Takeover via Shared Links

1 reports archived1 independent sourcesupdated 10/31/2026, 18:30:11
Synthesis & Latest Updates
1 Sources Cross-Validated

Security researchers discovered a critical vulnerability in ChatGPT allowing attackers to execute arbitrary JavaScript within a victim's authenticated session via malicious shared links. This flaw enabled enumeration of conversation lists, theft of private content, and full account takeover through authenticated API calls. OpenAI patched the P1 severity issue on October 26.

LATEST/Security researchers discovered a critical vulnerability in ChatGPT allowing attackers to execute arbitrary JavaScript within a victim's authenticated session via malicious shared links. This flaw enabled enumeration of conversation lists, theft of private content, and full account takeover through authenticated API calls. OpenAI patched the P1 severity issue on October 26.

Hourly heat curve

3 fully observed hours
Now
15.1
Peak
15.920:00
24h change
–

The line compares only sources observed throughout; gap hours are interpolated to keep the trend continuous.

Coverage timeline

Total 1 reports · Latest first
  1. Hacker News AIT2·85 pts

    Critical ChatGPT Flaw Allows Account Takeover via Shared Links

    • Attackers exploited ChatGPT's standard sharing feature to inject malicious code without requiring users to install plugins or enable developer tools.
    • Malicious scripts executed under the chatgpt.com domain with full access to the victim's authenticated session, enabling direct internal API calls.
    • Key lesson: Any public or shareable surface must be treated as attacker-controlled input, and cross-frame messages require strict authentication.