ChatGPT Shared-Link Flaw Exposed Private Conversations Before October Fix

Security researchers at Parameter demonstrated a vulnerability that allowed a specially crafted shared ChatGPT conversation to run attacker-controlled code in another user’s signed-in session and access private chats. The flaw was reported to OpenAI on October 18, 2026 and fixed on October 26. The researchers have not reported evidence of exploitation against ordinary users.

The attack used ChatGPT’s ordinary conversation-sharing feature. A malicious actor could prepare a public chat containing an interactive chart and an HTML preview, then send the sharing link to a potential victim.

A shared link could expose private conversations

In the researchers’ most reliable test, the recipient opened the shared conversation and clicked its Preview button. In a later version, the preview opened automatically, so following the link was the only action required.

Parameter reproduced the automatic version three times in a separate test account, with the malicious code running after approximately 4.5 seconds.

The victim did not need to install an application, provide a password or use developer tools. The flaw exploited how different components of the ChatGPT web interface communicated with one another.

How the security boundary was crossed

ChatGPT’s HTML preview ran in an isolated frame, intended to prevent untrusted content from directly accessing the main application. That isolation worked as designed.

However, the interactive chart loaded MathLive, a mathematical interface library whose virtual keyboard component accepted certain cross-frame messages without adequately verifying their origin.

Researchers found that the malicious preview could send a message that caused HTML to be rendered outside the original sandbox. A separate technique involving an allowed YouTube script endpoint helped bypass the application’s content security restrictions.

The combined effect was that code originating in an untrusted preview could execute in the context of the authenticated ChatGPT website. This was an application security issue, not a case of manipulating the language model through ordinary prompt instructions.

Researchers retrieved a conversation that had never been shared

In a controlled proof of concept, Parameter’s researchers used the victim session to list recent conversations, retrieve content from a private conversation that had not been shared with the attacker and transmit a small portion of that content to a researcher-controlled server.

Because the code ran with the user’s authenticated web permissions, the researchers argued that other actions exposed by the interface could also have been possible. Their published demonstration, however, was limited to the tested access and data transfer.

They did not establish that attackers had exploited the vulnerability against real users or that a widespread breach had occurred.

OpenAI classified the flaw as P1

The researchers submitted the vulnerability through OpenAI’s bug bounty programme on October 18 and provided an additional private-chat access demonstration the following day.

OpenAI reproduced the issue on October 21 and upgraded its severity classification from P2 to P1. Fixes were rolled out across two versions of the web interface, with the company confirming the vulnerability had been resolved on October 26.

Parameter received a total bug bounty payment of $5,000 for the report.

Implications for businesses using AI

Businesses use AI assistants to process internal documents, financial analyses and customer information, making flaws in surrounding software components a potential source of data exposure.

The HTML preview itself was sandboxed, but another component processed messages from it without sufficient origin checks. The weakness emerged from the interaction between otherwise separate features.

For enterprise users, the broader security considerations include limiting access permissions, setting rules for sensitive data, reviewing integrations and treating unsolicited shared links with appropriate caution.

Is the vulnerability still active?

According to Parameter’s disclosure, OpenAI fixed the reported flaw on October 26, 2026. Users do not need to install a patch for this particular web vulnerability.

Parameter said it had not found evidence that the flaw was exploited against users outside its controlled tests.

Sources: Parameter, “Do the Math: How We Took Over ChatGPT Accounts”, October 28, 2026; Cloud Security Alliance analysis, October 31, 2026; The Hacker News, October 31, 2026. Original Polish article on CEO.com.pl.