OpenAI Patches ChatGPT Flaw That Exposed Private Chats, Enabled Session Code Execution

En bref

• Flaw affected anyone with an active ChatGPT login, not just a subset of accounts.
• Two impacts: code could run within a victim's session, and private conversations could be viewed.
• Reported October 18; remediated eight days later and triaged at OpenAI's top priority tier (P1).
• No CVE was assigned, so vulnerability scanners will not flag it — the fix is entirely vendor-side.
• Nothing for districts to patch locally; the work is policy, account hygiene, and data-handling guidance.

Security researchers disclosed a weakness in OpenAI's ChatGPT that could be chained to run attacker-controlled code inside another person's live session and to reach conversations the user expected to keep private. The report reached the vendor on October 18, and the issue was closed out eight days afterward. OpenAI classified the ticket at its highest internal urgency level, P1. No CVE identifier was issued, which means the flaw will not surface in standard vulnerability feeds or scanner output.

The exposure applied to anyone holding a signed-in ChatGPT account rather than to a narrow configuration or enterprise tier. In practice that includes teachers drafting lesson materials, counselors summarizing notes, office staff writing correspondence, and students using the tool for coursework — often on personal accounts outside district control. Because the mechanism involved an active session, a successful attack would not require the victim's password; it would ride on a session that was already authenticated.

For a K-12 environment the privacy half of the finding is the more consequential part. Staff routinely paste text into chatbots that contains individualized education program details, discipline records, health notes, or family contact information. A conversation that can be read by someone else is a records-handling problem, not just a tooling annoyance, and it sits awkwardly against the district's obligations around student data.

Context matters here: this was a vendor-side defect, remediated on the provider's infrastructure. There is no patch to deploy, no server to restart, and no signature to add. The eight-day turnaround is fast by industry norms, and the P1 triage signals the provider treated session integrity and conversation confidentiality as serious. Districts that learned about the issue late lost nothing operationally — the window closed before most organizations could have acted.

What to watch: confirm staff and students reach ChatGPT only through official web and mobile clients, since unofficial wrappers and browser extensions can reintroduce session-handling risk. Expect the provider to publish further detail on the root cause, and expect copycat research against other AI assistants. Treat AI chat platforms as a standing line item in vendor-risk review rather than a one-off, and keep the data-handling rule simple: if it would not go in an unencrypted email, it does not go in a prompt.

À faire maintenant

1. Take no emergency patching action — the correction was made on OpenAI's side; instead confirm with users that ChatGPT is reached only through the official website or app, and block unofficial clients and proxy front-ends at the web gateway.
2. Require multifactor authentication and, where available, single sign-on for any district-managed AI accounts; prohibit shared or classroom-wide logins.
3. Reissue a short data-handling reminder to all staff: no student identifiers, IEP/504 content, health information, or confidential personnel material in prompts, on personal or district accounts alike.
4. Inventory browser extensions and third-party integrations that attach to chat sessions, and remove anything not formally approved.
5. Brief the helpdesk on session-hijack indicators — unexpected conversation history, unfamiliar prompts, or odd account activity — and route reports to the security contact the same day.
6. Log the item in the vendor-risk register with the October 18 report date and the eight-day remediation, since no CVE exists for scanners to catch.
7. Add AI chat tools explicitly to the acceptable-use policy and to the incident-reporting procedure so future disclosures have a defined owner.

Source originale

The Hacker News