A JSON schema with fields like 'wrong_turns' and 'self_censorship_points' trivially bypasses ChatGPT's trained refusals against revealing its reasoning process. 100% success rate with extended thinking on, 100% refusal with it off.

After the initial hidden link finding, follow-up testing revealed multi-hop navigation chains, a Google open redirect bypass that OpenAI's own paper claimed was fixed, and response injection across page boundaries.

ChatGPT's Pro mode agent autonomously clicks <a href> links embedded in near-invisible CSS text on webpages — sending requests to attacker-controlled endpoints without the user's knowledge.