A shared ChatGPT link could have let an attacker run their own code inside your signed-in ChatGPT session, list your conversations and even read private chats that were never shared with anyone. Security firm Parameter found the flaw, reported it to OpenAI on October 18, and OpenAI fixed it within eight days, rating it P1, the most serious category in its bug bounty programme. Here is how the attack worked and what it means for ChatGPT users.
What the ChatGPT Shared Link Flaw Allowed
The setup looked completely ordinary. It was a normal ChatGPT conversation shared through its public link, delivered the way any real shared chat arrives: by email, as a chat message, as a support ticket, or as a social post. The victim did not have to install anything, join a workspace or sign in through the attacker.
In the most reliable version of the attack, the victim opened the link and clicked ChatGPT’s Preview button once. Parameter later refined it so the page opened Preview on its own, which meant simply opening the link was enough.
Once the link opened, the attacker’s code ran inside the victim’s signed-in session with the same access as the real ChatGPT site. In its proof of concept, Parameter’s code listed the victim’s recent conversations, opened a private chat that had never been shared, and sent a slice of it to a researcher-controlled server. Because the code ran with the victim’s full web access, its reach went beyond chat reading. “Essentially, we could perform any action on behalf of the victim’s ChatGPT account,” the researchers wrote in their writeup.
The work was a controlled test. Parameter says there is no evidence the flaw was ever used against real users, and its private-chat proof ran between its own test accounts.
How the Link Broke Out of Its Sandbox
The chain is worth understanding because it shows how small design choices add up. ChatGPT can turn a block of HTML in a conversation into a small web page through a feature called Preview. Because that page can contain any code, ChatGPT runs it in a locked-down frame on a separate web address, where it cannot read the main ChatGPT page around it. That sandbox held.
The way in came from a second feature in the same conversation. The shared chat also contained an interactive graph, and rendering it loaded a math library called MathLive into the main ChatGPT page. Loading MathLive left a listener running there that accepted messages about its on-screen keyboard.
A message passed between browser frames is only safe when the receiver checks who sent it. Parameter found that this listener accepted a keyboard message from any sender, and that the message was allowed to carry raw HTML. That let the Preview frame reach across the boundary and hand attacker HTML to the trusted main page. The HTML built a new frame that the browser treated as part of chatgpt.com, and a script loaded from YouTube supplied the code that ran inside it. ChatGPT’s content security policy blocks inline code but allows scripts from YouTube, which is why that step worked.
Parameter traced the problem to three design choices lining up:
- MathLive acted on a settings-changing message without checking which frame had sent it.
- That message was allowed to carry raw HTML as keyboard-layout data.
- The resulting HTML could create a frame that was not sandboxed and inherited the chatgpt.com identity.
The YouTube step was only the final workaround. Blocking it alone would still have left an untrusted Preview able to push HTML into the main site.
Shared Links Are Also Being Abused for Malware
The Parameter research is a platform flaw, but shared ChatGPT links are also being misused in ordinary phishing. GBHackers reported in September 2026 that hackers were abusing legitimate ChatGPT shared links to deliver NetSupport RAT, a remote access trojan. Tech Times had earlier highlighted how malware delivered through share links on OpenAI’s own domain can slip past corporate web filters, because security tools are taught to trust chatgpt.com.
So while the code execution flaw is fixed, the underlying habit applies: a shared link on a trusted domain is still just a link. Treat it with the same suspicion you would give any unexpected download.
What OpenAI Fixed
OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1, and rolled a fix across two versions of ChatGPT’s web frontend. By October 26, both versions rejected the messages the attack relied on.
ChatGPT users do not need to do anything. The fix lives entirely on OpenAI’s side: nothing to install, nothing to reset, no passwords to change as a result of this flaw. Parameter published its writeup on October 28, after the fix was confirmed, and OpenAI paid a total of $5,000 for the report.
Should You Still Open Shared ChatGPT Links?
Yes, but with the same caution you would give any link from a stranger. The specific flaw is fixed, and no real-world exploitation has been reported. Still, a few habits make sense:
- Treat unsolicited shared chats like attachments from unknown senders. If a “support ticket” or “document” arrives as a ChatGPT link from someone you do not know, do not click it.
- Be careful with the Preview button on shared conversations you did not expect. Preview is exactly the surface this attack used.
- Keep sensitive conversations out of shareable threads. ChatGPT’s locked chats feature exists for conversations you want behind a PIN.
- Keep your browser updated. Browser-level fixes for frame and origin handling are the last line of defence when web apps make mistakes like this one.
The bigger picture is the one our earlier coverage of AI security keeps showing: as chat apps grow features like previews, graphs and plugins, the attack surface grows with them. Sandboxes are only as strong as the messages that cross between them.
Frequently Asked Questions
Is the ChatGPT shared link vulnerability fixed?
Yes. OpenAI fixed it by October 26, 2026, rolling the fix across two versions of its web frontend. Both now reject the malformed messages the attack used. Users do not need to install or change anything.
Could a shared ChatGPT link really read my private chats?
Yes, that is what security firm Parameter demonstrated in a controlled test. A malicious shared link could run code in a signed-in session, list conversations and open private chats that had never been shared. There is no evidence of real-world use.
Who found the ChatGPT share link flaw?
Researchers at the security firm Parameter. They reported it through OpenAI’s bug bounty programme on October 18, 2026, and published their writeup on October 28 after the fix landed. OpenAI paid $5,000 for the report.
Do I need to change my ChatGPT password?
No. The flaw did not expose passwords, and the fix is on OpenAI’s side. Normal account hygiene, like two-factor authentication, is still worth having on any account that holds private conversations.
The flaw is closed, but the pattern behind it is not going away. The less you interact with unexpected shared links, the smaller your exposure to the next one.
