--- title: "ChatGPT Share-Link Flaw Could Read Private Chats, Now Fixed" description: "Parameter showed a public ChatGPT share link could run code in a signed-in viewer's session and read private chats. OpenAI fixed it on October 26." url: https://publishmyblog.com/ai/chatgpt-shared-link-flaw/ section: "AI" author: "Saeed Shahriar" published: 2026-11-02T10:50:00.000Z --- # ChatGPT Share-Link Flaw Could Read Private Chats, Now Fixed If your team sends ChatGPT share links to clients, the link itself was the attack, and the fix needs nothing from you. Until late October, opening a malicious public ChatGPT share link could run an attacker's code inside your signed-in ChatGPT session. **Parameter's researchers used one to read a private chat.** OpenAI fixed the bug on October 26, eight days after the report. Ever opened a ChatGPT share link from someone you don't know well? Then this one's about you. ## What a ChatGPT share link could do The attacker builds a chat, shares it the normal way and sends the link by email, chat, a support ticket or a social post, according to [Parameter's write-up of the exploit](https://www.parameter.ai/labs/we-found-a-gap-at-openai). You didn't need to install anything, join the attacker's workspace or sign in through a page the attacker controlled, because the trap sat inside a ChatGPT share link itself. Here's how many clicks it took: - In the most stable version, you opened the share and clicked ChatGPT's normal Preview button once. - A later version opened Preview by itself, so opening the link was your only click, and the code fired after about 4.5 seconds. What could the code reach once you opened it? In the proof of concept, **it listed up to 20 of your recent conversations.** Then it read one private chat inside your signed-in ChatGPT session that had nothing to do with the share. **A small piece of it went to a server the researchers controlled.** That was a direct API call, made as you. Parameter says the code could have done anything you can do in your account. But the [Cloud Security Alliance's research note](https://labs.cloudsecurityalliance.org/research/csa-research-note-chatgpt-share-link-session-hijack-20261031/) calls **that wider claim an inference** from the access they had. ## Three flaws in a row The Preview sandbox itself held. The chain went around it: - A graph in the chat loaded MathLive, a math keyboard library, into the main page, and its listener took messages from any sender. - Those messages could carry raw HTML. - MathLive wrote that HTML into the page, where it built an unsandboxed frame carrying chatgpt.com's identity. A YouTube endpoint then got a script past ChatGPT's security policy, which Parameter calls the final workaround and not the root cause of the bug that let the code in. From there the script read your session token and called ChatGPT's own APIs as you. ## When OpenAI fixed it Parameter reported it through OpenAI's bug bounty program on October 18, four days after its team first got the chain running in ChatGPT's normal interface. OpenAI reproduced it on October 21. Severity went up to P1. **OpenAI fixed the bug on October 26** in both versions of its web frontend. Parameter says OpenAI awarded a $5,000 bounty that day. The researchers published on October 28. Was it used in the wild? The Cloud Security Alliance says, citing The Hacker News, that **Parameter reports no real-world exploitation.** OpenAI hasn't commented publicly on that. ## Why it matters You probably pass a ChatGPT share link around for everything: a prompt that worked, draft headlines, a cleaned-up brief. **The trusted address is what made this one risky.** You don't squint at a chatgpt.com URL, and neither do your clients. And think about what sits in your ChatGPT history right now: - client strategy and briefs - pricing notes - drafts of your [ad copy](https://publishmyblog.com/marketing/chatgpt-ads-ad-rewrites-default/) This bug needs nothing from you. The Cloud Security Alliance says the fix was server-side, and [MIXED's report](https://mixed-news.com/en/chatgpt-share-link-private-chats-exposure-fix-parameter/) notes **neither source shows any reader's account was compromised.** My read: your ChatGPT history is the real prize in a bug like this, because months of client work sit there in one place, readable by any code that runs as you. Still, I'd change one habit. Treat a ChatGPT share link like a Google Doc invite. **Open it only if you know the sender.** It's the [Rank Math PRO backdoor](https://publishmyblog.com/seo/rank-math-pro-backdoor/) lesson again. Trusted tools carry risk too. Anyway, do you build a site? **MathLive's listener took any origin by default**, the CSA says. Check your message handlers. ## Common Questions **Do I need to do anything about the ChatGPT shared link vulnerability Parameter found?** No. OpenAI fixed the bug on October 26, 2026, and the Cloud Security Alliance says the fix was server-side, so ChatGPT users don't need to update anything or change a setting. **Could the ChatGPT share link flaw read my private conversations?** In Parameter's proof of concept, yes: a ChatGPT share link ran code inside the viewer's signed-in ChatGPT session and read a private chat. OpenAI fixed the bug on October 26. **How much did OpenAI award for the ChatGPT share link bug?** Parameter says OpenAI awarded a total bounty of $5,000 on October 26, 2026, after raising the report's severity from P2 to P1. ## Sources - [Do the Math: How We Took Over ChatGPT Accounts](https://www.parameter.ai/labs/we-found-a-gap-at-openai), Parameter - [One Click Into Someone Else's ChatGPT: Cross-Frame Messaging Flaws](https://labs.cloudsecurityalliance.org/research/csa-research-note-chatgpt-share-link-session-hijack-20261031/), Cloud Security Alliance - [“Opening the shared link was the only required action”: ChatGPT privacy flaw is fixed](https://mixed-news.com/en/chatgpt-share-link-private-chats-exposure-fix-parameter/), MIXED