Parameter's research team found a one-click account takeover in ChatGPT: open a shared conversation link, and an attacker could read your private chats and ride your authenticated session. OpenAI confirmed and fixed it, and paid a $5,000 bounty — good process. The uncomfortable part is structural.
to full account takeover
benign features chained into the exploit
bounty — responsibly disclosed & fixed
Parameter's researchers turned three individually-harmless web features into a sandbox escape. A shared conversation carried a malicious preview that spoofed messages to ChatGPT's math keyboard; those messages smuggled raw HTML; and an unsandboxed iframe ran it with the full privileges of chatgpt.com. One click from the victim, no install, no login — and the attacker could read private conversations and act as the user.
This isn't a story about one careless bug, and it isn't a dunk on OpenAI — they handled disclosure well and shipped a fix. It's about where the risk lives. Put the assistant in the cloud, behind a feature-rich, shareable web surface, and you've concentrated two things in one origin: every private conversation you've ever had, and a growing attack surface you don't control. Every new convenience — a share link, an embedded preview, a math widget — is one more bridge an attacker can try to walk across. Parameter's own line says it best: isolation is only as strong as every bridge across it.
A one-click ChatGPT account takeover built from three benign features — a sender-spoofed message, an HTML injection, and an iframe that inherited the real origin.
When your AI lives in the cloud, your private conversations and your attack surface sit in the same place. One failed boundary spills both.
Remove the bridges. Intelligence that runs on the device in your room has no share-link surface, no cloud session to hijack, and no central store to exfiltrate.
Credit where it's due: Parameter found the gap, disclosed it responsibly, and OpenAI fixed it. That's the system working. But a patched bridge is still a bridge. The honest answer to “how do we make sure a shared link can never leak your conversation?” is to make sure the conversation was never on a shared surface to begin with.
Aura keeps the conversation in your room.
The wake word, the speech recognition, and the language model all run on a neural core in the device itself — no cloud round-trip, no account, no server that ever hears a word, and no shared link that could ever hand your history to a stranger. On-device isn't magic and it isn't immune to every threat — but it removes this entire class of them: there is no cloud session to steal and no central store to exfiltrate. For teams that need their own walls, Farsight runs the same intelligence on-prem.
Know someone who should see this? Send it to them.