RealFeedApp Researchers hijacked ChatGPT accounts via a shared link
By bypassing the sandbox and content security policy, the team executed malicious JavaScript in the victim's authenticated session. The payload could enumerate conversation lists and send private chat data to external servers.
- Field
- computer security
- What they did
- Researchers discovered a vulnerability that allows taking over any ChatGPT account by sending a link that executes malicious code when opened.
- Why it matters
- This enables attackers to access private chats, user correspondence, and data by using authenticated APIs of the service.
#chatgpt#security#sandbox#session hijacking#llm
