Researchers demonstrated that a crafted public ChatGPT conversation could execute attacker-supplied JavaScript inside a signed-in visitor's session, allowing enumeration of private chats and exfiltration of message content. OpenAI addressed the flaw on October 26 and rated the report P1.