After the initial hidden link finding, follow-up testing revealed multi-hop navigation chains, a Google open redirect bypass that OpenAI's own paper claimed was fixed, and response injection across page boundaries.

ChatGPT's Pro mode agent autonomously clicks <a href> links embedded in near-invisible CSS text on webpages — sending requests to attacker-controlled endpoints without the user's knowledge.