Is OA DALL·E Master - OpenAI人工智能绘画工具 safe?

OA DALL·E Master fetches its proxy config and access token over plaintext HTTP, letting anyone on the network read or redirect it.

The extension routes traffic to services like ChatGPT through a proxy server whose address it downloads from a remote config endpoint over unencrypted HTTP, along with the account access token embedded directly in the request URL. Because none of this control traffic is encrypted, a network-position attacker can read the access token or substitute a different proxy address. Separately, the same script used to run the extension's popup is also injected into every web page visited, causing it to send the page's IP address and referrer to the same remote server on every page load, whether or not the popup is opened.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.