Your ChatGPT history is a credential: protect it like your email

Would you leave your email inbox protected by a weak password and no second factor? Of course not. Yet many of us have been pouring into ChatGPT the kind of material that used to live only there: work plans, client details, health worries, half-formed decisions. The account that holds all of it is now a target, and the research of the last few weeks says it is a reachable one.

On October 28, Parameter's research team published a write-up claiming that, by bypassing ChatGPT's sandbox and content security policy, it could take over anyone's account simply by sending them a link. A dev.to write-up about a MathLive postMessage chain says OpenAI's fix shipped in eight days, and notes a $5,000 bounty for a full account takeover on the flagship product. Separately, Hacktron researchers reportedly chained an image-processing flaw on OpenAI's community forum with a single sign-on flaw to take over employee ChatGPT and Codex accounts. The Hacker News reports they used Anthropic's Claude Opus 5 to chain the two flaws and reach an internal OpenAI code repository.

The password was never the only weak point

Notice what these attacks have in common: as described, none of them seems to have needed a guessed password. A link, a forum login, an agent feature. In our reading, that matters for the usual advice. MFA is still table stakes, and security experts quoted alongside an ESET warning recommend it together with unique credentials and auditing third-party app permissions. But if an attacker takes over a session or an identity flow, a second factor at the login screen may never come into play. We can't say from the documentation exactly how each exploit interacts with MFA, so take this as our interpretation, not a finding.

What we do think is clear is the lesson about scope. ESET's point is that the damage depends on what you've shared and which services are connected. Someone asking for recipe ideas loses little. Someone who has uploaded client databases or corporate strategy, and linked connectors, has handed over a map of their life.

Memory and connectors turned history into an attack surface

The earlier ZombieAgent case is the part we find most underrated. Radware researchers described a zero-click flaw in ChatGPT and its Deep Research agents that abused memory and connectors to silently exfiltrate data and keep persistent access. According to the OECD's incident entry, OpenAI patched it in December 2025, but data theft had already occurred.

That's the pattern worth worrying about. Features that make an assistant useful, remembering you and reaching into your other services, are exactly what make a compromised account valuable. A chat history used to be a log. Now it's closer to a profile, plus a set of keys. That's why we'd call it a credential: whoever holds it can learn what you know and, sometimes, act as you.

Users should do the boring things; vendors should pay for the scary bugs

For users, the practical list is short and a little boring. Turn on MFA. Use a unique password. Review what's connected and disconnect what you don't use. And be honest about what you paste in: if you wouldn't put it in an email to a stranger, think twice about a chatbot. We'd also treat deletion as hygiene. Old conversations that you no longer need are risk with no upside, so clearing them is a sensible habit, even if how much a given plan lets you control is something to check in your own settings.

For vendors, the bar should move up. An eight-day fix, as the dev.to write-up describes it, is respectable, and we don't want to dismiss that. But a $5,000 bounty for full takeover of a product this central looks like an odd price signal, and the dev.to author hints as much. Companies should price these bugs like what they protect. They should also offer clear retention controls and make connectors opt-in and visible. Features like account switching, which OpenAI is rolling out on mobile and which keeps chats, settings and subscriptions separate for up to two signed-in accounts, are a convenience. They are also useful for separating work and personal use, which we think is good security hygiene in itself.

Treat your AI account as an inbox with a memory

Stop thinking of an AI account as an app and start thinking of it as an inbox with a memory. Lock it down like one, keep less in it, and connect fewer things to it. The password isn't the only door, so reduce what's behind all of them.