SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Researchers Show ChatGPT Share Link Could Hijack Signed-In Accounts; OpenAI Patched It

0
·6 views

Security firm Parameter published a writeup on October 28 describing how an ordinary public ChatGPT share link, opened once by a logged-in user, could run attacker-controlled JavaScript within that user's session. The flaw combined several features that were each defensible alone: a sandboxed Preview feature, an interactive graph loading the MathLive library, and a postMessage listener that did not verify its sender. Chained together, these gaps let injected HTML escape the sandbox and execute as chatgpt.com, bypassing the content security policy with help from a YouTube endpoint on its allowlist. OpenAI rated the report P1, paid a $5,000 bounty, and shipped a fix on October 26, eight days after the report was filed on October 18. Parameter says it tested the exploit only between its own accounts, and there is no evidence of real-world exploitation, nor do users need to take any action.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Closed-source and open-source AI weigh control, cost, and performance trade-offs

A practical overview examines the divide between closed-source and open-source AI models and what each approach means for users. Commercial systems such as those from OpenAI and Google are praised for strong performance and polished tooling, but they are criticized for limited transparency, high costs, and restrictive licensing. Open-source projects, including Gemma, offer local deployment, customization, and freedom from cloud dependence, though they face hurdles in performance, scalability, and ease of use. The article also cites community discussion suggesting that open models could become much cheaper through optimization and better memory management. Overall, it frames the choice as a trade-off between convenience and reliability on one side and transparency and control on the other.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Oracle Cloud Adds Google TPUs Alongside GPUs and Custom Chips, Forcing Data Center Shifts

Oracle Cloud Infrastructure has started offering Google Cloud Tensor Processing Units next to its existing GPUs and its own custom AI accelerators. Customers can provision TPU v5e pods through OCI for large training jobs and send inference workloads to Oracle's inference-focused chips, without managing separate accounts with multiple providers. The move pushes data center operators away from uniform single-vendor racks toward mixed hardware with different interconnects, memory bandwidth, and power and thermal requirements. Operators must update schedulers, cooling, power, and network fabrics, while software teams maintain multiple code paths, which adds engineering overhead but allows finer workload-to-hardware matching.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Food-scanning app keeps four region options, but region only changes disclaimer wording

A developer describes Munchable, an Expo-based React Native app that scans packaged foods for gut-condition fit. Onboarding asks users to pick one of four regions: United States, United Kingdom, European Union, or 'Somewhere else'. The chosen region does not reach the rules engine, so it alters only the phrasing of a medical-disclaimer line, not how labels are read. The author concedes that onboarding copy promising tailored label rules was inaccurate and should be corrected. The four-option design is deliberate, reflecting only the legal regimes the team has actually reviewed rather than all 195 countries.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Backpressure: How Node.js Avoids Memory Overload When Data Outpaces Processing

The article explains backpressure, a signal a data consumer sends to a producer asking it to slow down when it cannot keep up with incoming data. It uses a fast-food analogy in which a quick cook is held back by a slower cashier, leading to a pile-up that the feedback signal prevents. For Node.js developers, the piece notes that asynchronous reading can easily outpace writing, which without control can exhaust RAM and crash an application with an out-of-memory error. Node.js's Stream API addresses this through the boolean returned by write(), where a false value means the producer should pause until a drain event signals readiness to resume. The author presents backpressure as a core design feature that keeps systems stable rather than a bug.

0 comments Read more at DEV Community