Researchers hijacked ChatGPT accounts via shared links; OpenAI fixed it

Researchers exploited ChatGPT's HTML Preview and sharing features to build a malicious shared conversation; a victim only had to open the link for attacker-controlled JavaScript to run in their signed-in session, calling authenticated APIs, reading private chats and exfiltrating data. OpenAI fixed the issue on October 26 and rated it P1.

• OpenAI rewrites Model Spec with five ChatGPT principles2026-10-31
• OpenAI challenges B.C. privacy order in court2026-10-30
• OpenAI Publishes Community Safety Report, Adds New Teen Protections2026-10-30
• OpenAI Berlin DevDay: Dots Heads to Europe2026-10-28
• AI execs may be too out of touch to build for the general public2026-10-28