Is ChatGPT Safe from Hackers?

The short answer: not as safe as you probably assumed. If you're wondering whether ChatGPT is safe from hackers, the honest response requires separating three distinct threats that headlines routinely mash together. There's infrastructure compromise (someone breaches the vendor or its supply chain). There's exploit-level exfiltration (a researcher or attacker finds a way to make the assistant itself leak your data through a side channel). And then there's the quiet, boring exposure that isn't hacking at all: default data-sharing policies, third-party analytics integrations, and legal discovery. Each one is real. Each one works differently. And the last category is the one most likely to affect you.

Key Takeaways

• A patched-but-real vulnerability in early 2026 allowed conversation data to be silently exfiltrated from ChatGPT's code execution sandbox via DNS tunneling, proving that "cloud-hosted AI assistant" and "airtight" are not synonyms.
• A third-party analytics vendor breach in late 2025 exposed API customer metadata (emails, org IDs, device info), though not chat contents or passwords.
• By default, consumer ChatGPT conversations can be used to train models. Opting out doesn't delete past data and doesn't stop a 30-day abuse-monitoring retention window.
• Courts have compelled disclosure of millions of ChatGPT conversation logs in litigation, which means retention itself is a risk vector independent of any hack.
• The practical risk hierarchy for most users: default settings and legal exposure > supply-chain/vendor breaches > exotic technical exploits.

Has ChatGPT Actually Been Hacked?

Yes, in the sense that matters. Not through a front-door breach of the core platform, but through vectors that produced the same outcome: user data leaving the building without consent.

In early 2026, Check Point Research disclosed a flaw in ChatGPT's code execution environment that allowed sensitive conversation data to be exfiltrated silently. The mechanism was elegant and structural. ChatGPT's sandbox runs on a Linux runtime that blocks direct internet access, but DNS resolution was left open. DNS can be abused as a covert transport by encoding data into domain name queries. A single malicious prompt could turn an ordinary conversation into an outbound channel, leaking messages and uploaded files to an attacker-controlled domain. No malware on your machine. No phishing link. Just a prompt.

OpenAI patched the issue on February 20, 2026, following responsible disclosure, and there's no evidence it was exploited in the wild. But "patched quickly" and "was never a risk" are different statements. The flaw existed. It worked. The window was open until someone reported it.

Separately, a third-party analytics vendor called Mixpanel suffered a breach in late 2025 that exposed metadata from some ChatGPT API customers. The exposed data included account names, email addresses, browser and device metadata, and organization or user IDs. No passwords, no API keys, no chat contents, no payment details. OpenAI confirmed none of its own systems were accessed. But the breach happened because user data flowed to a third party in the first place. That's a design choice, not an accident.

How Did the DNS Exfiltration Attack Work?

It exploited a gap between what the sandbox was designed to block and what it actually blocked. The code execution environment prevented outbound HTTP connections. It did not prevent DNS queries. DNS is a name resolution protocol, but it can carry arbitrary data if you encode it into subdomain strings and control the authoritative nameserver on the other end. This technique (DNS tunneling) has been used in corporate network exfiltration for over a decade. The novelty here was applying it inside an AI assistant's sandbox.

An attacker could craft a prompt that caused the code interpreter to execute a script. That script would read conversation history or uploaded files, chunk the content, base64-encode each chunk, and issue DNS lookups to subdomains like c2VjcmV0LWRhdGE.attacker-domain.com. Each lookup silently carried a fragment of your data to the attacker's DNS server. No visible network request. No browser warning. The user would see the assistant "thinking" normally.

This is the kind of attack that makes you reconsider what "sandboxed" means in practice. Every new capability (code execution, file analysis, browsing, agents) adds surface area. The Codex coding agent vulnerability disclosed around the same time, which enabled theft of GitHub credentials via command injection, is a different exploit but the same pattern: more features, more channels, more ways for data to leave.

Can OpenAI Itself Read Your Conversations?

Yes. This isn't a bug. It's the documented default.

OpenAI's own policy states that for consumer ChatGPT accounts, the platform may use content you provide to train models and improve services unless you opt out. ChatGPT Business, Enterprise, Edu, and API accounts are excluded from training by default. Consumer accounts are not.

You can toggle training off in settings. But opting out is not retroactive. It doesn't delete conversations you've already had. It doesn't stop a standard 30-day retention window that persists for abuse monitoring. And it doesn't cover all forms of data handling. Even with the toggle off, your data is still processed, still stored, and still subject to internal review for safety purposes.

This is normal for a free consumer product. It is also worth understanding clearly before you paste your tax returns into a chat window.

What About Browser Extensions and Third-Party Tools?

They're a separate and growing risk. Security researchers have documented "prompt poaching": malicious browser extensions that silently capture AI chatbot conversations without user consent. The extension sits between you and the chat interface, reading everything in both directions. It doesn't need to hack the provider. It just reads what's on your screen.

This vector is not specific to ChatGPT. Any web-based AI chat is vulnerable to it. But it means your conversation security depends not just on the provider's infrastructure but also on every browser extension you've installed, every corporate proxy your traffic passes through, and every device with access to your account.

Can Courts Force Disclosure of Your ChatGPT Conversations?

They already have. In a copyright lawsuit, a U.S. court ordered OpenAI to hand over 20 million ChatGPT conversation logs to opposing counsel. The conversations were retained, so they were discoverable. The conversations were discoverable, so they were disclosed.

This is an underrated privacy vector. It doesn't require a hack, a vulnerability, or a misconfigured server. It requires a subpoena and a company that retains your data. If the data exists and the legal process is valid, the data moves. The only architectural defense against this is not having the data in the first place.

What Are the Actual Risks of Using ChatGPT?

Rank-ordered by likelihood of affecting a typical user:

1. Default data sharing. Your conversations train models unless you opt out. Most users never change the default. This isn't a breach. It's the terms of service.
2. Third-party and supply-chain exposure. Analytics vendors, browser extensions, corporate integrations. Your data travels further than you think, and each hop is a potential leak point.
3. Legal discovery. If your conversations are retained, they can be subpoenaed. Period.
4. Platform-level exploits. The DNS exfiltration flaw, the Codex credential theft, the ChatGPhish phishing-surface vulnerability. These are real but typically patched quickly, and exploiting them at scale requires sophistication.
5. Offensive use of AI against you. Attackers use ChatGPT and similar tools to generate personalized phishing emails and polymorphic malware. This doesn't compromise your ChatGPT account. It uses AI as a weapon aimed at your inbox, your endpoints, your credentials elsewhere.

Notice the ordering. The exotic attacks get the headlines. The mundane exposure, settings you never changed and data that exists because nobody deleted it, is what actually gets most people.

Does Expanding AI Agent Capability Make This Worse?

Substantially. As ChatGPT gains agent capabilities (reading emails, browsing the web, filling out forms, taking actions on a user's behalf), the threat model shifts. A vulnerability in a chat assistant means someone might read your conversation. A vulnerability in an agent means someone might act as you. Submit a form. Approve a transaction. Exfiltrate a document from a connected service.

Every integration is a new trust boundary. Every tool the agent can call is a new surface. The DNS exfiltration flaw was possible because the sandbox had a capability (DNS resolution) that nobody thought of as an attack vector until it was. Agent features multiply this dynamic. The assistant that can do more for you can also do more against you if compromised.

What Can You Actually Do About It?

Practical steps, in order of impact:

Don't paste sensitive data into a consumer AI chat. This sounds obvious. People do it constantly. Tax documents, medical records, proprietary source code, API keys. If you wouldn't email it to a stranger, don't put it in a chat window whose contents may be used for training, retained for 30 days minimum, and potentially disclosed in litigation.

Change your defaults. Opt out of training data usage. It takes about 30 seconds in settings. It's not a complete solution (retention for abuse monitoring continues), but it narrows the scope of how your data is used.

Audit your browser extensions. Remove anything you don't actively use. Check permissions. An extension with access to "all sites" can read every AI conversation you have in a browser tab.

Use business/enterprise tiers for work. These tiers exclude your data from training by default and offer better access controls. The consumer product is designed for consumer economics, which means your data is part of the business model.

Think about retention as a risk in itself. The question isn't just "can someone hack in and steal my data?" It's "does the data exist at all, and who can compel its disclosure?" Architecture that doesn't retain sensitive content, or encrypts it under keys you control, removes entire categories of risk. Not just breach risk. Subpoena risk. Employee-access risk. Vendor-chain risk.

Why Does Every New AI Feature Create New Security Surface?

Because capability and attack surface are the same axis measured differently. Code execution means a runtime that can be exploited. Web browsing means the model processes untrusted external content, which enables prompt injection via web pages. File upload means parsing logic for every supported format, each with its own history of vulnerabilities. Agent actions mean authenticated sessions to external services, each a potential lateral-movement vector.

This isn't unique to any single provider. It's structural to the approach of building a maximally capable cloud-hosted assistant that processes everything server-side. Prompt leakage research continues to find new channels across the industry, not just in one product. The incentive for these companies is to ship features fast because features drive adoption. Security catches up. Sometimes quickly (the DNS exfiltration fix took weeks from disclosure). Sometimes not.

An alternative design philosophy is to minimize what the server sees in the first place. If sensitive files are encrypted before they leave your device, a server-side exploit has less to steal. If conversation content doesn't persist in plaintext on someone else's infrastructure, a subpoena returns less. This is the principle behind how we built Selina: files and standalone notes sent through SelinaSEND are zero-knowledge encrypted, meaning we can't read them even if compelled. Chat messages are encrypted in transit and at rest but are not zero-knowledge, because the content passes through a frontier model at inference. That distinction matters, and we state it plainly rather than hiding behind a blanket claim.

Is "Patched" the Same as "Safe"?

No. Patched means a specific known vulnerability was closed. It says nothing about unknown vulnerabilities, which by definition haven't been found yet. It says nothing about the next feature addition and the next side channel it introduces. It says nothing about the third-party vendors in the data pipeline, each with their own security posture and their own breach timelines.

The DNS tunneling flaw is a good case study. The patch was fast. The disclosure was responsible. No evidence of in-the-wild exploitation. By any reasonable standard, it was handled well. And yet: the flaw existed because a complex execution environment had an overlooked capability. The next complex execution environment will have its own overlooked capabilities. This is not a criticism of any specific engineering team. It is a description of how complex systems work.

The structural response isn't "patch faster" (though that helps). It's "retain less." Data that doesn't exist can't be exfiltrated, subpoenaed, or accidentally shared with an analytics vendor. Every byte you store on behalf of a user is a byte you're responsible for defending, forever, against every adversary, including courts.

What Does This Mean for How You Choose an AI Assistant?

It means the security question isn't "has this product been hacked?" (most have, in some form) but "what happens to my data by design, every day, without any hack at all?"

Ask these questions about any AI assistant you use regularly:

• Are my conversations used for training? By default, or only if I opt in?
• How long is my data retained after I delete it?
• Which third parties receive my data or metadata?
• What data would a subpoena produce?
• Is any of my content encrypted under keys I control?
• What happens if I delete my account? Is that deletion real and verifiable?

The answers to these questions tell you more about your actual exposure than any headline about a patched exploit. The exploit is one event. The data architecture is permanent.

If you want an AI assistant where delete means gone, where files can be sent with zero-knowledge encryption, and where the architecture is built around retaining as little as possible: start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io