Vulnerabilities · AI Security · Privacy
OpenAI fixed a ChatGPT flaw that let shared links steal private chats
A researcher found that a malicious ChatGPT share link could run code in your session and read private chats. OpenAI fixed the flaw eight days after it was reported.
Ross Grant2 min read
The short version
Researchers found that if you clicked a shared ChatGPT link made by an attacker, it could let them read your private chats. OpenAI fixed the problem quickly after it was reported. You do not need to do anything to stay safe, as the fix is already in place.
By the numbers
- 8 daystime from report to fixThe Hacker News
- $5,000bug bounty paid to researchersThe Hacker News
What happened?
A security firm found that a shared ChatGPT link could let an attacker run code in a user's session and read their private chats. The flaw was reported to OpenAI on 18 October 2026 and fixed eight days later. OpenAI rated it as their most severe type of bug and paid $5,000 to the researchers.
How the flaw works
A security firm called Parameter found that a shared ChatGPT conversation link could let an attacker run code inside the session of anyone who opened it. This meant the attacker could access the victim's private ChatGPT chats, even those never shared before. The attack worked by abusing two features in ChatGPT's web interface: the Preview (which displays HTML content in a sandboxed frame) and an interactive graph that loaded a math library called MathLive.
The researchers discovered that MathLive left a listener running on the main ChatGPT page. This listener accepted messages from any browser frame, not just trusted ones, and allowed those messages to carry raw HTML. By combining this with the Preview feature, an attacker could get their HTML code executed in the main ChatGPT page, which ran with the victim's full access.
The attack chain ended with a script loaded from YouTube, which was allowed by ChatGPT's content security policy. This script then sent a portion of a private chat to a server controlled by the researchers. The researchers stressed that their test was controlled and did not target real users. They found no evidence of the flaw being used in the wild.The Hacker News (opens in a new tab)
The response
Parameter reported the vulnerability to OpenAI through its bug bounty programme on 18 October 2026. OpenAI reproduced the issue, raised its severity to P1 (the highest level in their system), and fixed it within eight days. The fix stopped the messages that allowed the attack, and OpenAI rolled it out to both versions of ChatGPT's web frontend by 26 October. OpenAI paid the researchers $5,000 for their report.
Is there a fix?
OpenAI has fixed the vulnerability on its side. There is nothing ChatGPT users need to install or reset. The researchers published their findings only after the fix was in place.
What you should do
No action is needed from ChatGPT users. The flaw was on the server side and has already been patched. However, this case is a reminder to be cautious with shared links, even from trusted platforms. Security teams should review how third-party scripts and browser frames interact in their own web applications.
Claimed vs confirmed
- Confirmed
Attackers could use a shared ChatGPT link to run code and read private chats.
Researchers at Parameter demonstrated this in a controlled test, and OpenAI confirmed and fixed the flaw.
- Denied
The flaw was used in real-world attacks.
Parameter said their test was controlled and found no evidence of real-world exploitation.
Why it matters
This flaw could have let attackers read private ChatGPT conversations just by tricking users into clicking a link. It shows how complex web features can interact in unexpected ways, creating serious security risks even on trusted platforms.
Key points
- A shared ChatGPT link could let attackers run code and read private chats.
- The flaw was reported and fixed within eight days by OpenAI.
- No real-world attacks were reported; the test was controlled.
- OpenAI paid $5,000 to the researchers for the discovery.
- Users do not need to take any action, as the fix is server-side.
Sources
The Hacker News
Reference
