GoKawiilSecurity researchers found a ChatGPT exploit letting attackers hijack accounts via a shared link
A research team discovered a vulnerability in ChatGPT's share and HTML Preview features that let attackers run malicious JavaScript inside a victim's authenticated chatgpt.com session simply by sending them a link. Once opened, the code could read the victim's private conversations and call ChatGPT's authenticated APIs on their behalf, effectively taking over the account without any further action from the victim. OpenAI fixed the issue on October 26 and classified it as a P1 (critical) vulnerability.