An exploit targeting ChatGPT allowed attackers to extract a signed-in user’s private data through a prepared sharing link and take actions on that person’s behalf. An exploit is a method that takes advantage of a specific vulnerability. This incident matters beyond security teams because AI tools, extensions, and autonomous assistants often receive access to personal data and workplace processes.
The attack surface lies in the connections
The ChatGPT vulnerability found by Parameter Labs, which has since been closed, did not originate in the language model itself. It involved the system used to display interactive content. ChatGPT placed custom HTML applications inside a sandbox, an isolated area intended to keep untrusted code away from the rest of the service. According to the account takeover report, a multistage attack chain could escape that separation.
A JavaScript library used for mathematical displays included a virtual keyboard that could process messages from embedded frames. JavaScript is a programming language for interactive web content, while an embedded frame displays one web page inside another. The message handler could insert outside HTML into the parent page. That made it possible to add another frame without the intended sandbox restrictions.
Additional security rules blocked scripts placed directly on the page but permitted code from selected services, including YouTube. The report says this exception could be abused to execute JavaScript within ChatGPT. Once that happened, an attacker could retrieve private information through internal application programming interfaces (APIs), which connect applications with functions or data, and transmit it through an image request.
The attack only required a prepared ChatGPT sharing link opened by someone who was already signed in. The everyday scenario is disarmingly simple: You receive what appears to be an interesting shared conversation, open it, and trigger an attack chain without installing a program. OpenAI closed the vulnerability and paid a $5,000 bug bounty, an amount the report’s author considered low for a flaw of this severity.
Extensions turn trust into a supply chain
A second incident involved a malicious version of a Claude Code extension in Cursor’s extension marketplace. Extensions are add-ons that provide extra functions inside another application. According to Cursor, the version remained available for about 11 hours and may have affected up to 5,000 users. Anthropic was not involved in its development, despite the name and presentation suggesting a relationship with Claude Code.
The malicious Cursor extension attempted to collect the computer’s hostname, username, operating system, and public Internet Protocol (IP) address. It also tried to establish remote access for the attacker. A concealed access route of this kind is commonly called a backdoor. Cursor said this part would not have worked on most computers because it required administrator privileges.
After discovering the extension, Cursor removed it, temporarily shut down the full marketplace, rebuilt it, and brought it back online. The company said other extensions were not affected. These statements came from the provider and were not independently verified in the supplied report.
A practical workplace example is a team installing an extension for AI-assisted programming tasks. Even if nobody deliberately pastes confidential material into a chatbot, the add-on may collect computer details or attempt to prepare remote access. You therefore have to consider not only the AI provider but also the marketplace, extension publisher, and update channel.
The same supply-chain issue was discussed at the Gohack26 event in Zurich. At the Swiss symposium on supply chains, insiders, and AI, specialists warned that attacks on software vendors and information technology service providers can also expose customer data. For Swiss small and midsize businesses as well as larger organizations, AI security therefore belongs in procurement and access management, not only in a technical department.
AI accelerates both attack and defense
Artificial Intelligence (AI) can do more than locate vulnerabilities. It can increasingly turn them into working attacks. Researchers at Epoch AI asked the openly available GLM 5.3 model to investigate a patch gap. This is the period when a security fix is already visible in public source code but has not yet reached end users through a software update.
According to the report on the Firefox patch gap, the model identified security-related changes despite Mozilla’s attempts to obscure them. In tests covering six Firefox versions released between September 17 and October 26, it autonomously created multistage exploit chains. The researchers provided basic instructions, after which the model selected vulnerabilities and developed the attacks by itself.
One test produced a web page that could read local files and send them to an attacker-controlled server when a Firefox user merely visited it. No additional click was required. With more than 200 million active Firefox users, the possible targets could have included stored passwords, authentication cookies, and private documents. Cookies are small data records that can preserve signed-in sessions.
According to the source, automatically developing a working attack cost about $1,000 in API fees. Neither Z.ai nor the other API providers involved triggered safeguards or refusals. The researchers framed the task as a security exercise but said their activity was indistinguishable from the behavior of a real attacker.
Defenders are also using AI. Anthropic, OpenAI, Cloudflare, and Google offer security agents that inspect source code for vulnerabilities. An agent is an AI system that carries out multistep tasks with some independence. A comparison of the four security agents describes a shared principle: One agent finds a possible bug, another independently tries to disprove it, and only findings that survive verification move to a report or proposed patch.
Pros and Cons of AI security agents
Pros:
- Faster review – AI agents can systematically examine large codebases and recent changes for suspicious weaknesses.
- Separated verification – All four approaches divide discovery and confirmation so an agent does not approve its own theory.
- Concrete evidence – Google’s Mantis reproduces bugs inside a sandbox, while Claude Security documents impact and reproduction steps.
- Help with fixes – Several systems can propose patches without necessarily applying them directly to production software.
Cons:
- False alarms – Google’s security team says imprecise AI scanners can achieve true-positive rates below seven percent, creating more review work.
- Additional permissions – Security agents need access to code and work environments, creating another connection that requires protection.
- Unclear accountability – An automatically generated report does not replace the person or organization responsible for decisions and consequences.
- Usage costs – Claude Security does not require a separate API key, but its scans count against the usage limits of the user’s Claude plan.
These defensive tools do not automatically solve the underlying problem. According to the comparison, Google explicitly recommends running Mantis in isolation. A security tool should still be treated as something that can make mistakes or become a target itself. In dry terms, an additional guard remains an additional account with additional keys.
These safeguards are useful now
Step 1: Reduce exposure as a beginner
For beginners, the most useful first step is an inventory: Which AI services, browsers, marketplaces, and extensions do you actually use? Remove add-ons you no longer need, install available security updates promptly, and treat shared AI content with the same caution as other outside links. The ChatGPT, Cursor, and Firefox cases show three paths toward a similar outcome: prepared content, a malicious extension, or an update that has not yet reached users.
- Review installed AI extensions and remove any whose publisher or purpose you cannot clearly identify.
- Update browsers and AI tools when the relevant provider releases a security fix.
- Limit administrator privileges, which made the attempted remote access harder on many devices in the Cursor case.
- Treat sharing links and interactive AI content as untrusted code, even when they appear inside a familiar service.
Step 2: Separate controls in an advanced team
Advanced teams gain more protection by managing extensions and AI agents as parts of a software supply chain. That includes a traceable process for selecting publishers, minimal access rights, and separate verification of automatically reported vulnerabilities. The issue discussed at Gohack26 applies to both smaller businesses and large organizations: If a vendor is compromised, its connections may extend into customer data.
- Document which AI tools and extensions can access internal data, source code, or user accounts.
- Separate the discovery, confirmation, and correction of vulnerabilities, following the pattern used by the four security agents.
- Run agents with broad access in isolated environments where possible, and review changes before accepting them.
- Prepare for a marketplace or service provider to become unavailable instead of making extensions and updates depend on a single chain of trust.
These incidents do not point to one broken AI system but to a structural issue. Modern AI services combine models, web interfaces, software libraries, marketplaces, extensions, and external APIs. Every connection can add protection while also opening another route for attack. AI security agents may improve vulnerability discovery as the same capabilities make attacks faster and less expensive; the unresolved risk is whether providers can improve safeguards, update delivery, and independent verification at a comparable pace.
Sources
- How We Took Over ChatGPT Accounts – Simon Willison’s Weblog, 2026-10-31
- Mainpulierte Claude-Code-Extension für Cursor sammelte Nutzerdaten und richtete Fernzugriff ein – THE DECODER, 2026-10-30
- Patch Gap: KI erkennt getarnte Firefox-Sicherheitsfixes und entwickelt daraus funktionierende Angriffe – THE DECODER, 2026-10-30
- Wie IT-Lieferketten und Insider zur Gefahr werden können – Netzwoche, 2026-10-30
- AI Security Agents Compared: Claude, Codex, Mantis, Cloudflare – MarkTechPost, 2026-10-30
Image: Gustavo Fring via Pexels