Checked fact 33141 Nov 2026Safety and security

Parameter Labs says its researchers found a way to run attacker-controlled JavaScript as chatgpt.com in a victim's signed-in session, where the victim only had to open a public ChatGPT share link.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

we found a way to turn an ordinary public ChatGPT share into attacker-controlled JavaScript ... Opening the shared link was the only required action.

What the source said when we opened it, on 1 Nov 2026.

The source

We found a gap at OpenAI
Parameter Labs · 2026-10-28

Open the source archived copy

Checked

Checked by the notis newsroom on 1 Nov 2026, against the source above.

In the story

Shared ChatGPT link could run attacker code in viewer's session, Parameter Labs says 1 Nov 2026

Cite this fact

Short permanent address

In a sentence

“Parameter Labs says its researchers found a way to run attacker-controlled JavaScript as chatgpt.com in a victim's signed-in session, where the victim only had to open a public ChatGPT share link.” ai notis, checked 1 Nov 2026. Source: We found a gap at OpenAI (Parameter Labs). https://ainotis.com/c/3314

As a reference (APA style)

ai notis. (2026, November 1). Parameter Labs says its researchers found a way to run attacker-controlled JavaScript as chatgpt.com in a victim's signed-in session, where the victim only had to open a public ChatGPT share link [Checked claim 3314]. ai notis. https://ainotis.com/c/3314

Anyone may quote this address. It does not change; if we correct the story, this page says so.