Breaking

Critical ChatGPT Flaw Reportedly Let a Single Shared-Conversation Link Hijack Accounts and Expose Private Chats

November 2, 2026 at 12:28 EST

Security

A critical vulnerability in ChatGPT reportedly allowed an attacker to use a malicious shared conversation to run JavaScript of their choosing inside another user's signed-in session, potentially enabling account hijacking and theft of private conversations with a single link.

Critical vulnerability · ChatGPT

One malicious shared link could run code in a signed-in ChatGPT session

A reported flaw let an attacker use a shared conversation to execute JavaScript inside another user's authenticated session, potentially enabling account takeover and theft of private conversations.

1 link

The only action required: a victim opens a malicious shared conversation.

0 phishing

No fake login page or typed credentials are needed, unlike typical phishing.

Critical

Severity as characterized in the report of the flaw.

How the attack flows

From a shared link to a hijacked session

STEP 1

Attacker shares a malicious conversation link

→

STEP 2

Victim opens the link while signed in

→

STEP 3

Attacker's JavaScript runs in the victim's session

→

STEP 4

Account is taken over and private conversations are read

Still unconfirmed

What the available summary does not establish

No detailed technical write-up or proof of concept was included
Affected product versions and the time window are not specified
No official OpenAI statement on a fix, patch date, or remediation
No evidence that the flaw was exploited in the wild

General guidance for users

Protect accounts with strong, unique passwords and multi-factor authentication
Be cautious about opening unfamiliar links
Review active sessions in your account settings

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.