Key Takeaways Researchers at Parameter disclosed on October 28, 2026 that a publicly shared ChatGPT conversation could run attacker-supplied JavaScript in the signed-in session of anyone who opened it, allowing the attacker to list the victim’s conversations, read a private chat that had never been …