This weekly recap describes a real, now-patched ChatGPT flaw that let an attacker turn a normal shared conversation link into code that ran in a recipient's signed-in ChatGPT session. An attacker could send a malicious shared chat link and, if opened, potentially access private conversation data and send it to an outside server.
Parameter Labs disclosed a now-patched flaw in ChatGPT's conversation-sharing feature. An attacker could create a malicious conversation, publish it using the platform's normal sharing feature, and send the resulting link to a target. Because the link used ChatGPT's standard sharing mechanism, it looked like an ordinary shared conversation rather than a suspicious external link.
When a recipient opened the share while signed in, the payload executed as chatgpt.com with access to the victim's authenticated web session. From that position, an attacker could enumerate the victim's conversation list, retrieve content from a private conversation, and send that data to an external server.
This technique succeeded because it abused a trusted, native feature rather than a fake login page or obvious phishing email. A shared ChatGPT link is a routine part of normal workflows for developers, knowledge workers, and executives who use the tool daily. There was no spoofed domain or obvious red flag in the URL itself, since the payload ran inside the legitimate chatgpt.com origin using the victim's own session.
This mirrors classic social-engineering patterns: a colleague or external contact appears to share something relevant to the recipient's work, and the recipient is asked to open it without much friction or verification.
Organizations should treat unexpected shared AI-chat links like any other external link: confirm the sender and the business reason before opening them while signed in. Employees should avoid placing sensitive business, customer, financial, or security information in AI conversations unless the organization has approved that use.
The broader roundup also notes that spyware distribution often relies on sideloaded or repackaged legitimate apps delivered through social-engineering flows, reinforcing that software should only be installed from approved sources. This technique maps to adversary behaviors described in attack.mitre.org/techniques/T1566/002 (spearphishing link) and attack.mitre.org/techniques/T1204/001 (user execution via malicious link), both of which rely on a user trusting and acting on a link that appears legitimate.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An attacker could publish a malicious conversation using ChatGPT's normal sharing feature and send the link to a target. Opening the link while signed in could run attacker-controlled JavaScript as chatgpt.com within the victim's authenticated session.
Successful exploitation could allow an attacker to enumerate the victim's conversation list, retrieve content from a private conversation, and send data from that conversation to an external server.
No, the flaw disclosed by Parameter Labs has been patched.
All employees using ChatGPT or other AI tools, developers, executives, and anyone handling sensitive information in AI conversations should be aware of this risk.
A ChatGPT share link can look completely normal. Parameter Labs found a now-patched flaw: someone could publish a malicious conversation, then send its ordinary shared link. Opening it while signed in could run JavaScript as chatgpt.com. That’s the surprise: the link looked legitimate, but the page could reach your private chat list and send conversation content to an outside server. The warning sign is an unexpected link with no clear work reason. This flaw is patched. Still, before opening an unexpected shared chat, confirm with the sender why they sent it.
Researchers demonstrated that malicious web pages and local previews can abuse embedded browsers in popular AI coding assistants. The attacks can hide instructions from users, spoof trusted login addresses, or access sensitive files, creating realistic risks for developers who open untrusted links…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
Attackers took over the verified official HBO Max Reddit account and used it to run a 48-hour wave of malicious ads. The ads sent people to lookalike download sites that tricked them into copying and running commands, leading to information-stealing malware on both macOS and Windows. Researchers…
Check Point Research identified a real campaign, tracked as Yoba, that uses fake GitHub projects and websites posing as new ChatGPT and Claude desktop applications. Victims searching for AI tools can be directed to convincing pages for supposed releases such as GPT-6 Astra and Claude Opus, then…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
