TLDR:The state variable that ChatGPT uses in the integration with plugins, was not random. Attackers could install a malicious plugin on a victim by sending a link that mimic the last step of the OAuth flow.The takeaway: If your company has an OAuth, make sure the state parameter is random. That's a common...
A lot of developers are not sure about the answer.Security researchers from Salt could install malicious ChatGPT plugins, just because of a minor state mistake that ChatGPT made.If you want to understand OAuth, this post is for you: https://salt.security/blog/security-flaws-within-chatgpt-extensions-allowed-access-to-accounts-on-third-party-websites-and-sensitive-data
According to a recent study by Salt, a Booking.com attack could have potentially affected 100 million users. The attack is related to OAuth, a commonly used mechanism on modern websites.More information (links) on the first comment.
If I were you, I would indeed start exploring other options on a small scale. Don't actively interview, but talk to friends, make a list of workplaces that would be happy to have you, so that on the day of reckoning, you will be prepared for any scenario.
It is interesting to hear what they want, and as an employee, I agree. However most of the companies I know want to see the employee at least one day a week, I think it's a fair compromise.
Good luck!