It sounds like he needs to get the victim to ask ChatGPT to visit the malicious website. So there is one extra step needed to exploit this

> All a target needed to do was instruct the LLM to view a web link that hosted a malicious image. From then on, all input and output to and from ChatGP