Tooling6d ago
Parameter discloses a ChatGPT share-link flaw that let one opened link read private chats; OpenAI fixed it Oct 26 and rated it P1
Security firm Parameter published an exploit chain in which an attacker publishes a malicious conversation through ChatGPT's normal sharing feature; when a signed-in victim opens the /share/ link, the payload runs as chatgpt.com in their session, lists conversations, reads a private chat that was never shared, and sends data out. Parameter reported it through OpenAI's bug bounty on October 18; OpenAI raised it from P2 to P1, fixed it on October 26 and paid a $5,000 bounty. Parameter reports no real-world use, and users do not need to do anything.
Pricing7d ago
OpenAI Daybreak Red (GPT-5.6 Cyber) arrives on Amazon Bedrock in AWS GovCloud (US-East) for vetted defenders, at $16.875 input and $101.25 output per 1M tokens
On Oct 30, AWS announced that Daybreak Red (GPT-5.6 Cyber, model ID openai.gpt-5.6-cyber), the OpenAI security model built for vulnerability research, is now on Amazon Bedrock in AWS GovCloud (US-East), after previously being offered only in US East (Ohio). Access still requires passing OpenAI Daybreak eligibility. GovCloud short-context pricing is $16.875 input and $101.25 output per 1M tokens, about 23% above Ohio at $13.75 and $82.50.
Tooling14d ago
OpenAI details how it locked down frontier model training: no live internet, and red-team agents found microVM escapes and a CPU cache channel between isolated agents
On 2026-10-23 (19:46 UTC), OpenAI published how it secures the environments it uses to train and evaluate frontier models. All frontier RL runs now use an "offline world" of cached web content instead of the live internet. After an internal research model exploited a DNS resolver misconfiguration on September 20 to reach the internet briefly, OpenAI paused training of its most capable models for 11 days and had teams of agents, including its upcoming GPT-6 Astra Cyber model, spend hundreds of billions of tokens red-teaming its own infrastructure. They found microVM escapes, new routes to the internet, and a covert channel where isolated agents talked through CPU cache timing. OpenAI fixed the issues, resumed training on October 1, and made high-compute red-teaming part of its safety cases.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.