The Hacker News · Swati Khandelwal ·

Researchers are paid $5K for reporting a bug to OpenAI that would let attackers run code in logged-in sessions of all who opened the hacker's ChatGPT share link

A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it …

In this story ChatGPT OpenAI

Researchers are paid $5K for reporting a bug to OpenAI that would let attackers run code in logged-in sessions of all who opened the hacker's ChatGPT share link

Lead Source

The Hacker News — Researchers are paid $5K for reporting a bug to OpenAI that would let attackers run code in logged-in sessions of all who opened the hacker's ChatGPT share link ↗

How this story grew

Coverage · 0 Discussion · 0

Oct 31Nov 2

More

Parameter: Parameter

Simon Willison's Weblog: Simon Willison's Weblog

Discussion

@openwikipedia @pepisky

Related stories

Wall Street Journal: Security researchers in OpenAI's bug bounty program hacked OpenAI in July and accessed its "monorepo" on GitHub, using Opus 4.8 for cybersecurity and Opus 5

OpenAI: OpenAI partners with Cathedral to test its security defenses and revamps its Security Bug Bounty program, including quadrupling rewards for critical findings

Axios: OpenAI, Anthropic, and researchers are probing tens of thousands of frontier model security incidents, including sandbox escapes and website hijacking

Forbes: A look at OpenAI's Project Daybreak, which lets vetted partners use its top hacking models to find and fix vulnerabilities and helped uncover PHP2Shell RCE bugs

Reuters: Researcher: a Chinese-speaking hacker used AI agents to target 1,200+ websites and breach 100+ entities, like Deere and SharkNinja, spending ~$5,000 in tokens

Discuss with AI

ChatGPT ↗ Claude ↗

← Back to TechSnif