Expired60% confidenceCautionExact time
Third-party top-up tutorials that require users to log in and copy page content to a third-party URL expose session tokens leading to session hijacking; even after changing a password, the token chain remains valid until the server actively revokes it.
2
Sources
60%
Confidence
Medium-term (~90 days)
Relevance
7/11/2026
First Seen
This claim has expired. It is kept for the record and no longer describes the current state.
Valid until: 10/9/2026(expired)
Sources
The Truth About "GPT-5.6": Debunking Fake Rumors and Third-Party Top-Up Scams
bilibili小小阿白6667/9/2026
Related Claims
Unverified将登录后的ChatGPT页面内容复制粘贴到第三方网址会暴露会话令牌，攻击者可静默刷新access_token实现账号持续控制，即使修改密码在令牌被服务器撤销前依然有效85% similarUnverifiedThird-party services that require copying and pasting account information carry a potential risk of account details being recorded or misused.79% similarUnverifiedThird-party platforms confirm account ownership by reading cookies, essentially borrowing the browser's already-logged-in state rather than requiring a plaintext password, but session hijacking risks still exist.75% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/478956API
curl https://kongchang.com/api/v1/knowledge/claims/478956MCP
get_claim(id=478956)