Unverified60% confidenceFactExact time
The third-party card key top-up process requires users to copy their ChatGPT account's session token and paste it into the top-up website
2
Sources
60%
Confidence
Medium-term (~90 days)
Relevance
9/21/2026
First Seen
Valid until: 12/20/2026
Sources
Related Entities
Related Claims
Unverified将登录后的ChatGPT页面内容复制粘贴到第三方网址会暴露会话令牌，攻击者可静默刷新access_token实现账号持续控制，即使修改密码在令牌被服务器撤销前依然有效76% similarUnverifiedThe account information code submitted by users is typically the ChatGPT login token (Session Token), whose permissions are equivalent to direct account access, posing risks of conversation history and bound information leakage.75% similarUnverifiedIn the demo, ChatGPT was able to check for duplicate account charges, identify a duplicate subscription, and carry out the actions of canceling it and sending an email to request a refund.72% similarUnverifiedProviding a token to a third party is equivalent to handing over full account access for the duration of its validity, allowing the other party to read chat history and modify account settings.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/938306API
curl https://kongchang.com/api/v1/knowledge/claims/938306MCP
get_claim(id=938306)