We Took over ChatGPT Accounts

Commenters treated the story less as an isolated phishing mishap than as an embarrassing security failure for a company asking the world to trust it with conversations, files, and increasingly agentic work. The reported chain could let a malicious link seize a ChatGPT account, and readers were especially angered that the company valued disclosure at only $5,000. To them, that price signals that finding and responsibly reporting a severe flaw is barely worth the effort, despite the potential exposure of sensitive AI chats and connected workflows. The thread also pushed back on the easy answer that users should simply avoid links. Email security scanners can automatically follow URLs, while ordinary product emails routinely train people to use login and update links. Several readers argued that systems must withstand those realities rather than outsourcing security to perfect user behavior. Technical commenters corrected speculation that OAuth state handling was necessarily involved, describing the apparent issue instead as an old, preventable cross-window messaging trust failure. A smaller but sharp line of criticism connected this lapse to OpenAI's claims about powerful coding agents and enormous AI-generated codebases. If frontier programming systems are presented as transformative, commenters expect the company to ship boringly solid security, not repeat web vulnerabilities with account-level consequences. The one bright spot was that the report was accepted and the affected frontends were fixed, with readers appreciating the detailed proof-of-concept chain.