ChatGPT Shared Link Flaw Let Attackers Read Your Private Chats
A malicious ChatGPT shared link could run an attacker’s code inside the signed-in session of anyone who opened it, letting them list and read that person’s private conversations, security firm Parameter has disclosed. OpenAI fixed the flaw on October 26, 2026, rated it P1, its most serious severity level, and paid a $5,000 bug bounty.
The researchers reported the issue on October 18 and published their full technical writeup on October 28, after the fix was live. There is no report of the bug being used against real users, and ChatGPT users do not need to do anything.
How the ChatGPT shared link attack worked
The trap was an ordinary public ChatGPT conversation, shared with the same /share link anyone can create. An attacker could send it by email, in a chat, in a support ticket or in a social media post. The victim did not have to install an app, join a workspace or sign in through an attacker’s page.
In the most reliable version, the victim opened the link and clicked ChatGPT’s Preview button once. In a later version, the researchers made the Preview open on its own, so simply visiting the link was enough. It is a sharper version of an older worry about ChatGPT share pages, which previously surfaced when shared conversations leaked online through search results.
The chain combined two harmless looking features in one conversation. Preview turns HTML in a chat into a small web page and runs it in an isolated frame on a separate web address. That sandbox held. But the same chat also contained an interactive graph, which loaded a math library called MathLive into the main ChatGPT page.
MathLive left a listener running that accepted messages about its on-screen keyboard from any sender, and those messages could carry raw HTML. The isolated Preview used that gap to push attacker HTML into the trusted page. That HTML created a new, unsandboxed frame that the browser treated as part of chatgpt.com. Because ChatGPT’s content security policy allowed scripts from YouTube, the researchers abused a YouTube oEmbed endpoint to run their own JavaScript inside that frame.
What an attacker could do
Once running, the code called ChatGPT’s own authenticated APIs as the victim. In Parameter’s controlled test between separate accounts, it listed recent conversations, opened a private chat that had never been shared, and sent a small piece of it to a server the researchers controlled.
Parameter said the reach was not limited to chats. “Essentially, we could perform any action on behalf of the victim’s ChatGPT account,” the researchers wrote.
OpenAI’s fix and what it means for you
OpenAI reproduced the attack on October 21 and raised its severity from P2 to P1. It rolled fixes across two versions of ChatGPT’s web frontend, and by October 26 both rejected the cross-frame messages the attack relied on. The bounty was paid through OpenAI’s program on Bugcrowd.
The fix is server side, so there is nothing to update or reset. The broader lesson is that AI chat apps now bundle code previews, plugins and rich widgets into one page, and each new feature widens the attack surface. This week, a tampered Claude Code extension showed a similar risk on the developer tool side.
For people who keep work and personal chats in ChatGPT, it is also a reminder to treat unexpected shared conversation links with the same caution as any other link. OpenAI recently made it easier to keep those apart with ChatGPT account switching on mobile.
Your comment has been submitted,
it will be published after approval.