Researcher finds phishing-link injection in ChatGPT Trusted Contact emails

• A reported ChatGPT flaw lets a sender-controlled recipient name become part of a Trusted Contact invitation, creating a place to inject phishing text or links, according to marckohlbrugge's report.
• The sample lure impersonated an OpenAI and X creator partnership and sent recipients to authportal.co, as shown in the phishing-email screenshot.
• The available evidence points to sender spoofing rather than a confirmed compromise of OpenAI's authenticated mail pipeline: the attached header recording shows mismatched Return-Path and X-Sender fields.

OpenAI’s Trusted contacts guide says invitations can arrive by email, SMS, WhatsApp, or in-app message, and expire after one week. The reported phishing-email screenshot carries a fake creator-program pitch, while the DMARC overview explains why a visible From address does not by itself prove authenticated delivery. AIandDesign's post also shared an example with Design Twitter.

Trusted Contact is an optional ChatGPT safety feature. OpenAI says each eligible personal account can have one contact, requires an email address, optionally accepts a phone number, and sends an invitation through one or more available channels. Invitees have one week to accept, according to OpenAI’s setup documentation.

The invitation is therefore a service-generated message carrying data entered by the account holder. The reported problem centers on how one of those fields is rendered.

marckohlbrugge reported that ChatGPT inserts the recipient’s name into the outgoing invitation. The same report says an attacker can place a long string in that field, including a URL intended to steal credentials.

The finding describes content injection through a trusted-data field. The recipient does not need to see a separate attacker-controlled sender for the malicious text to appear inside an invitation that looks connected to ChatGPT.

The sample message used a fake “OpenAI x X Partnership” and “Creator Program Access” invitation as its lure. It claimed that ChatGPT Plus subscribers would receive AI-generated posting schedules, real-time topic recommendations, automated performance tracking, and priority access to X monetization tools.

The message directed recipients to authportal.co and added urgency by describing the offer as limited to selected Plus subscribers. The sender line displayed “OpenAI” and noreply@tm.openai.com, according to the screenshot.

The original report questioned how the message could use an authenticated-looking @openai.com sender address in marckohlbrugge's original post. A later screen recording opens the message headers and highlights mismatched Return-Path and X-Sender fields.

A reply from nicklaunches suggested that the message could involve a spoofed header, noting that SPF and DKIM do not always stop display-name spoofing in the reply. DMARC describes authentication as an alignment check between the purported sender and SPF or DKIM results, not merely a trusted-looking From line DMARC’s overview.

The evidence supports a phishing message impersonating OpenAI. It does not, by itself, establish that OpenAI’s authenticated delivery systems accepted attacker-controlled content.

OpenAI’s public documentation says a legitimate Trusted Contact invitation includes the ChatGPT user’s name and email address so the recipient can reach out. If a later safety notification is sent, OpenAI says it shares only a general description of the concern, not chat details or transcripts OpenAI’s feature guide.

The feature is documented as available to adults with personal ChatGPT accounts, while shared Business, Enterprise, and Edu workspaces are excluded from the rollout OpenAI’s availability notes.