Parameter Labs discovered a complex exploit against ChatGPT's HTML previews, allowing attackers to exfiltrate private user data. OpenAI patched the vulnerability and paid a $5,000 bug bounty.
Related articles
See all- Cryptography
4 real? Tracking exploitation and patching of eMudhra’s weak keys
Cloudflare warns that the number four is enough to compromise unpatched connections using eMudhra certificates. It reports rapid patching and evidence of attempted exploitation, but the provided excerpt contains no technical details or exposure figures.
- net-tools
Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, .NET Tools, Toolbox App, and Gateway Now
eMudhra certificates have been compromised, affecting JetBrains tools. Users are advised to update their IDEs and related tools to versions 2025.2.6.* to address security issues.
- Security
ERC draft: Independent Simulation Result for (STVA)
A new ERC draft proposes standardizing the format, hashing, and verification of independent simulation results to enhance security and reliability in blockchain transactions. This standard ensures that any compliant simulator produces identical outputs for the same inputs, protecting against compromised frontends.
- Community
Coding Agent Horror Stories: The CVE That Did Not Exist
An AI code review agent invented a CVE and recommended dangerous fixes. Docker's post highlights containing agents with Docker Sandboxes and verifying their output.
- Security
Scoped Capability Tokens for STVA
Scoped Capability Tokens are short-lived, revocable authorization tokens that grant specific actions, enhancing transaction security by eliminating broad approvals. They are designed to integrate with independent simulations and account authority lifecycles, supporting offline verification and revocation.
- Cryptography
Post-quantum signatureless authorization with recursive verification
A new technique for signatureless authorization using proof-of-knowledge and recursive verification has been introduced, which is resistant to quantum threats. This approach involves publishing a commitment to a reusable secret and authorizing actions with randomized zero-knowledge proofs, addressing security challenges like safe reuse.