Researchers are paid $5K for reporting a bug to OpenAI that would let attackers run code in logged-in sessions of all who opened the hacker's ChatGPT share link (Swati Khandelwal/The Hacker News)

OpenAI fixed a vulnerability in ChatGPT share links that could let an attacker execute code in the active session of any logged-in user who opened a malicious link, creating potential exposure of chats, credentials, and connected business data. For CIOs, this is a reminder that AI collaboration tools expand the enterprise attack surface and should be governed with the same rigor as other SaaS and identity systems, including user awareness, endpoint/browser protections, and monitoring for untrusted shared content.