A shared ChatGPT link could have exposed private account data through a flaw OpenAI has now fixed. That is a fairly unpleasant amount of trust to pack into a link.
A ChatGPT sharing hole is closed
Simon Willison describes a ChatGPT vulnerability found by Parameter Labs that let an attacker create a share URL capable of stealing a signed-in visitor’s private data or taking actions on their behalf.
The problem involved HTML previews, the interactive mini-apps ChatGPT displays inside a restricted area of the page. Those restrictions are supposed to keep generated code away from your account. Parameter Labs found a chain of weaknesses that let code escape those boundaries, run on the main ChatGPT page and access private account data.
For anyone sharing AI-generated tools or opening someone else’s, the distinction matters: this attack began with visiting a shared page. It did not require installing a browser extension or handing over a password.
Treat unfamiliar interactive previews with the caution you would give unfamiliar software, even when the surrounding site is familiar. Willison says OpenAI closed the hole and paid Parameter Labs a $5,000 bug bounty.
A compromised extension reached Cursor users
The Claude extension distributed through Cursor had a malicious release, version **2.1.313**, that Cursor says affected at most 5,000 users. Security researchers Kevin Beaumont and Luke Roberts say it came through Anthropic’s official marketplace account.
This is relevant if you or someone handling your business’s code uses that extension in Cursor. Ars Technica’s Dan Goodin says anyone who installed or updated it between **5:27 a.m. and 4:35 p.m. Eastern on Thursday, October 29**, should consider themselves affected. Roberts says Cursor extensions update automatically by default.
Cursor says the malicious code collected machine information and attempted to establish persistent remote access. Coding errors prevented parts of the backdoor from working in some circumstances.
Cursor says it blocked further distribution and worked with the hosting provider to cut infected devices off from the attacker’s server. Its extension marketplace has reopened after key rotation and access checks.
One signal to refuse AI scraping
A shared AI opt-out setting is getting support from OpenAI, Google, Microsoft and Anthropic. The proposed “policy token” goes in a website’s robots.txt file, where site owners already give instructions to automated crawlers.
For those responsible for a business website, this could simplify managing whether its content is collected for AI training. Today, those preferences have to be set separately for individual AI companies. It is a signal participating companies promise to honor, not a technical barrier against every scraper.
Microsoft says its controls will distinguish training from grounding, which means consulting information to support an AI answer, while preserving Bing search visibility.
Anthropic has already adopted the signal. OpenAI says support is coming in the “coming months”; Google and Microsoft plan to support it in 2027.
Also
- Restaurant reservations by text. Zest says its text-message concierge can check availability and book through services including OpenTable, Resy and SevenRooms.
- Nintendo inside Qwen. Simon Willison says Drew Breunig built an NES CPU emulator into Qwen3.5-4B’s weights that runs games very slowly.
- A haiku from orbit. Google says its experimental satellite ran Gemma 4 on onboard AI chips, with twin interconnected satellites planned for 2027.
Pass it on