News · Oct 28, 2026
A shared ChatGPT link could read the victim's session token and private chats, Parameter says
Parameter disclosed on October 28 a chain that let a shared ChatGPT conversation run script as chatgpt.com, read the viewer's session token and call ChatGPT's APIs as them, including pulling private chats. OpenAI fixed it by October 26 and paid a $5,000 bounty.