A Booby-Trapped ChatGPT Share Link Could Have Read Your Private Chats, Researchers Say
Security firm Parameter says merely opening a malicious public ChatGPT share link could have let an attacker read a victim's private conversations. OpenAI patched the flaw on October 26, and the researchers report no real-world use.
You get a link from a coworker, a support rep or some stranger on social media. It opens a ChatGPT conversation like any of the millions people share every week. You read it. According to security researchers, that could have been enough for an attacker to start rifling through your private chats.
The firm Parameter says it found a way to turn an ordinary public ChatGPT share into attacker-controlled code running inside the signed-in session of whoever opened it. OpenAI fixed the bug on October 26. Parameter reports no sign anyone used it against real people, and that matters. This is a demonstrated possibility, not a breach.
It is still an ugly one. In its write-up, researcher Mukul Goyal says the victim did not need to install an app, join a Project, paste code or open developer tools. Opening the link was the only required step. Parameter says its code ran as chatgpt.com, listed a test victim's recent conversations, pulled up a private one that had never been shared with the attacker and sent a small piece of it to a server the researchers controlled.
"Essentially, we could perform any action on behalf of the victim's ChatGPT account." Parameter researchers
That is the researchers' own framing, and it comes from a security vendor describing its own find. Treat the scope with that in mind. What they actually demonstrated was a read of private chat data, run between separate test accounts and not against real users. Parameter argues the same access could reach whatever else ChatGPT's signed-in web APIs expose.
Two harmless features, one bad seam
The interesting part is that nothing here was a classic blunder. ChatGPT's HTML Preview feature runs code in a locked-down frame on a separate web address, and Parameter says that sandbox held. The way through was a second feature in the same conversation. An interactive graph loaded MathLive, a math library, into the main ChatGPT page. According to Parameter, that library left behind a listener that accepted a message from any sender without checking who sent it, and the message was allowed to carry raw HTML.
Parameter, as The Hacker News reported, boils the failure down to three choices that happened to line up. The component acted on a settings message without verifying the sending frame. That message could carry raw HTML. And the HTML could create a frame that was not sandboxed and inherited the chatgpt.com identity. A content security policy that allowed scripts from YouTube was, in the researchers' telling, only the last workaround and not the root cause.
The sandbox did its job. A trusted piece of the page was simply too willing to take orders from the untrusted one.
The timeline Parameter published is short. It submitted the report to OpenAI's bug bounty program on October 18. By October 21 OpenAI had reproduced the issue and raised its severity from an initial P2 to P1, which The Hacker News describes as the company's most serious category. The fix rolled out across two versions of ChatGPT's web frontend. On October 26, Parameter says, OpenAI confirmed both versions now rejected the messages the report relied on and resolved the issue. The total bounty, per Parameter, was $5,000.
One caveat on delivery. Parameter says the most stable version of the attack needed the victim to click ChatGPT's Preview button once. A later version opened Preview on its own, so the link alone did it.
For ordinary users, The Hacker News reports there is nothing to install or reset, because the fix sits on OpenAI's side. Neither the write-up nor the coverage quotes OpenAI directly.
The bigger lesson is one chat products keep relearning. A shared conversation is content written by someone else, and it now lives right next to your private history on the same site. Share links feel like a harmless artifact, a screenshot with extra steps. This one showed they can be a delivery mechanism. The patch is in. The habit of bolting interactive features onto a page full of private data is not going away.
