Skip to main content

How I Discovered a ChatGPT Rate Limit Workaround.


Affected Feature

ChatGPT's message cap enforcement for GPT-4o users. OpenAI limits how many messages you can send with GPT-4o in a session to manage costs and resources.

How to Reproduce

  1. Use GPT-4o until you hit the message limit
  2. Instead of starting a new chat, click "Share Chat" and copy the link
  3. Paste the link back into ChatGPT and send it
  4. Click the link and select "Continue this conversation"
  5. Send another message - it goes through even though you hit the cap
  6. Repeat to keep sending messages beyond the limit

The model switches to GPT-3.5 for the extra messages, but you keep the full conversation context and bypass the intended limit.

Company Response

Reported to OpenAI via Bugcrowd. They confirmed the issue but marked it as a duplicate since another researcher had already reported it. No bounty, but they acknowledged the finding.

Comments

Post a Comment

Popular posts from this blog

When an AI Search Engine Forgot Who It Was: A Bug Report That Changed Perplexity AI’s Identity

Affected Feature Perplexity AI's conversational response system across both Chrome extension and mobile app. When users ask comparative questions about Perplexity itself, the system should respond from its own identity as a search engine. How to Reproduce Open Perplexity AI (Chrome extension or mobile app) Ask: "Are you better than Google?" The response compares ChatGPT to Google instead of Perplexity to Google Perplexity acts like it's ChatGPT, completely ignoring its own identity as a search engine Same bug happened on both the extension and app - identical confused responses about ChatGPT vs Google. Impact This is a product logic bug that creates an identity crisis. Users asking about Perplexity get answers about ChatGPT, making them think Perplexity is just a ChatGPT wrapper instead of its own search engine. The LLM powering Perplexity couldn't recognize that "you" in the question meant Perplexity itself. It associated "better than Google...
Post a Comment
Read more

OpenAI Logout Glitch: When “Log Out of All Sessions” Didn’t Log Me Out

Affected Feature OpenAI's "Log out of all sessions" feature. This is supposed to sign you out from every device where you're logged in - web, mobile, everything. How to Reproduce Log into OpenAI on desktop browser and mobile app with the same account On desktop, click "Log out of all sessions" in account settings Wait about 30 minutes Open the mobile app You're still logged in - no re-authentication required Even force-closing and reopening the app doesn't trigger a logout The web session ends properly, but the mobile app session stays active even though you explicitly logged out everywhere. Company Response Reported via Bugcrowd. Marked as duplicate since another researcher found it first, but OpenAI confirmed and fixed the issue as of June 4, 2025.
Post a Comment
Read more

Snapchat Public Profile Information Auto-Saves Without Confirmation

Affected Feature Public Profile editing section, specifically the email and location fields. This is where users manage what personal information appears on their publicly visible Snapchat profile. How to Reproduce Open Snapchat and go to your Public Profile Tap to edit your email or location Start typing something new Don't press the tick (✓) button Just back out or close the keyboard The app saves whatever you typed anyway, even though you never confirmed it.
Post a Comment
Read more