Back to News

Researchers Paid $5K for ChatGPT Bug Allowing Code Execution via Share Link

275 points · 125 comments#chatgpt#security#bug-bounty#openai

Researchers reported a ChatGPT security bug to OpenAI and received a $5,000 bounty. The flaw allowed attackers to run code in the logged-in session of any user who opened a malicious share link. The issue was disclosed on October 31, 2026.

Coverage timeline

  1. Hacker Newsarmcat
    We Took over ChatGPT AccountsHN
  2. Techmeme
    Researchers are paid $5K for reporting a bug to OpenAI that would let attackers run code in logged-in sessions of all who opened the hacker's ChatGPT share link (Swati Khandelwal/The Hacker News)

    Swati Khandelwal / The Hacker News : Researchers are paid $5K for reporting a bug to OpenAI that would let attackers run code in logged-in sessions of all who opened the hacker's ChatGPT share link — A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it …

Related stories

  • OpenAI offers up to $500 monthly API credits to ChatGPT Pro, Business subscribers

    OpenAI has introduced a new benefit granting ChatGPT Pro and eligible Business subscribers up to $500 in free monthly API credits, with the amount recurring each billing cycle as long as the subscription and benefit remain active. The credits are calculated based on subscription tier: Pro users receive credits equal to their subscription cost, while Business workspaces accumulate $20 per Standard seat and $100 per Premium seat, capped at $500 per month (or $6,000 annually for yearly billing). Eligible users must have an active subscription for at least 7 days, and first-time credit amounts may be prorated based on the remaining subscription period.

    2 reports · 2 sources

  • PHP2Shell critical RCE flaws patched; exploited before disclosure

    PHP released security updates (8.5.12, 8.4.27, 8.3.36, 8.2.35) fixing two critical unauthenticated remote code execution vulnerabilities, collectively dubbed PHP2Shell, affecting up to 70% of websites. The flaws were discovered in August by OpenAI's GPT-5.6 Sol and independently by Google's Wiz, and AWS reported exploitation starting October 17, four days before public disclosure.

    6 reports · 2 sources

  • OpenCode Maker Anomaly Innovations Reports Breach of ~1.4% of Console Users' API Keys

    Anomaly Innovations, maker of the open-source coding agent OpenCode, disclosed a breach affecting roughly 1.4% of OpenCode Console users and their API keys, describing it as a large-scale distillation attack. Hackers accessed part of the online platform, stole API keys, and ran up charges on users' AI accounts; the AI tools OpenCode relied on reportedly refused to analyze the malicious code.

    2 reports · 2 sources

  • OpenAI Chrome extension lets ChatGPT view and use open browser tabs

    OpenAI has upgraded its ChatGPT Chrome extension to allow ChatGPT to view and use open browser tabs when users tag Chrome in the ChatGPT web or desktop app. The update brings computer use capabilities to Chrome users, as demonstrated in a video where ChatGPT compares three open tabs showing sofas.

    1 reports · 1 sources

News updates every hour. Subscribe in your RSS reader to get new stories automatically.

Subscribe