We Took over ChatGPT Accounts

Researchers bypassed ChatGPT's security policy and took over accounts by sending a link to a malicious conversation, which executed as the victim's authenticated web session. The payload could enumerate conversations, retrieve private content, and send data to an external server. OpenAI fixed the issue on October 26 and classified it as a Priority 1 (P1) vulnerability.