ChatGPT Share-Link Flaw Could Read Private Chats, Now Fixed
If your team sends ChatGPT share links to clients, the link itself was the attack, and the fix needs nothing from you.
Until late October, opening a malicious public ChatGPT share link could run an attacker’s code inside your signed-in ChatGPT session. Parameter’s researchers used one to read a private chat.
OpenAI fixed the bug on October 26, eight days after the report.
Ever opened a ChatGPT share link from someone you don’t know well? Then this one’s about you.
What a ChatGPT share link could do
The attacker builds a chat, shares it the normal way and sends the link by email, chat, a support ticket or a social post, according to Parameter’s write-up of the exploit.
You didn’t need to install anything, join the attacker’s workspace or sign in through a page the attacker controlled, because the trap sat inside a ChatGPT share link itself.
Here’s how many clicks it took:
- In the most stable version, you opened the share and clicked ChatGPT’s normal Preview button once.
- A later version opened Preview by itself, so opening the link was your only click, and the code fired after about 4.5 seconds.
What could the code reach once you opened it? In the proof of concept, it listed up to 20 of your recent conversations.
Then it read one private chat inside your signed-in ChatGPT session that had nothing to do with the share. A small piece of it went to a server the researchers controlled.
That was a direct API call, made as you.
Parameter says the code could have done anything you can do in your account. But the Cloud Security Alliance’s research note calls that wider claim an inference from the access they had.
Three flaws in a row
The Preview sandbox itself held. The chain went around it:
- A graph in the chat loaded MathLive, a math keyboard library, into the main page, and its listener took messages from any sender.
- Those messages could carry raw HTML.
- MathLive wrote that HTML into the page, where it built an unsandboxed frame carrying chatgpt.com’s identity.
A YouTube endpoint then got a script past ChatGPT’s security policy, which Parameter calls the final workaround and not the root cause of the bug that let the code in.
From there the script read your session token and called ChatGPT’s own APIs as you.
When OpenAI fixed it
Parameter reported it through OpenAI’s bug bounty program on October 18, four days after its team first got the chain running in ChatGPT’s normal interface.
OpenAI reproduced it on October 21. Severity went up to P1. OpenAI fixed the bug on October 26 in both versions of its web frontend.
Parameter says OpenAI awarded a $5,000 bounty that day.
The researchers published on October 28.
Was it used in the wild? The Cloud Security Alliance says, citing The Hacker News, that Parameter reports no real-world exploitation.
OpenAI hasn’t commented publicly on that.
Why it matters
You probably pass a ChatGPT share link around for everything: a prompt that worked, draft headlines, a cleaned-up brief. The trusted address is what made this one risky.
You don’t squint at a chatgpt.com URL, and neither do your clients.
And think about what sits in your ChatGPT history right now:
- client strategy and briefs
- pricing notes
- drafts of your ad copy
This bug needs nothing from you. The Cloud Security Alliance says the fix was server-side, and MIXED’s report notes neither source shows any reader’s account was compromised.
My read: your ChatGPT history is the real prize in a bug like this, because months of client work sit there in one place, readable by any code that runs as you.
Still, I’d change one habit. Treat a ChatGPT share link like a Google Doc invite. Open it only if you know the sender.
It’s the Rank Math PRO backdoor lesson again. Trusted tools carry risk too.
Anyway, do you build a site? MathLive’s listener took any origin by default, the CSA says.
Check your message handlers.
Common Questions
Do I need to do anything about the ChatGPT shared link vulnerability Parameter found?
No. OpenAI fixed the bug on October 26, 2026, and the Cloud Security Alliance says the fix was server-side, so ChatGPT users don’t need to update anything or change a setting.
Could the ChatGPT share link flaw read my private conversations?
In Parameter’s proof of concept, yes: a ChatGPT share link ran code inside the viewer’s signed-in ChatGPT session and read a private chat. OpenAI fixed the bug on October 26.
How much did OpenAI award for the ChatGPT share link bug?
Parameter says OpenAI awarded a total bounty of $5,000 on October 26, 2026, after raising the report’s severity from P2 to P1.
