ChatGPT: One Shared Link Could Read Your Private Chats

Sharing a ChatGPT conversation takes one click. For a while, opening one could have been the whole attack. Researchers at the security firm Parameter showed that a booby-trapped share link could run their code inside a victim's logged-in ChatGPT session, enough to list recent conversations and read a private chat that was never shared with anyone.

The victim did not have to install anything or sign in through the attacker. In the most reliable version of the attack, they opened the link and clicked ChatGPT's Preview button once. A later variant opened Preview on its own, so the link itself was enough.

How the trap worked

ChatGPT's Preview feature turns a block of HTML in a chat into a small web page, locked inside a sandboxed frame. That sandbox held. The way in came from a second feature in the same conversation: an interactive graph that loaded the MathLive math library into the main page. MathLive left a listener running that accepted keyboard messages from any sender, and those messages could carry raw HTML. The sandboxed Preview could then hand attacker HTML to the trusted page, and a script loaded from YouTube, allowed by ChatGPT's content security policy, supplied the final payload.

Once running, the code called ChatGPT's own signed-in APIs directly. "Essentially, we could perform any action on behalf of the victim's ChatGPT account," the researchers wrote. This was a controlled test: Parameter reported no real-world use of the flaw.

Fixed, and you don't have to do anything

Parameter reported the flaw through OpenAI's bug bounty program on October 18. OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1, its most serious category, and shipped a fix across both versions of ChatGPT's web frontend by October 26. The report earned $5,000. The fix is entirely on OpenAI's side: nothing to install, reset, or change. The usual advice still costs nothing: treat an unexpected shared-chat link like any other link from a stranger.