ChatGPT Share Link Flaw Enabled Private Chat Access
A ChatGPT share link flaw allowed attacker-controlled code to run inside another person’s signed-in session and access private conversations, security firm Parameter demonstrated. A share link is a public web address for showing someone a conversation. The vulnerability has been fixed, and Parameter reported no evidence that it was exploited against real users.
Parameter submitted the flaw through OpenAI’s bug bounty program, which rewards researchers for responsibly reporting security weaknesses, on October 18. OpenAI reproduced the code execution and private-chat test, raised its severity rating from P2 to P1, its most serious category, and fixed the issue eight days after the report. Parameter published its findings on October 28, after the repair was in place, and received a total payment of $5,000.
The attack began with an otherwise ordinary conversation shared through ChatGPT’s public-link feature. A malicious link could have been delivered through email, a chat message, a support ticket or a social media post, just like a legitimate shared conversation. The recipient did not need to install software, enter an attacker-controlled workspace or sign in through a page supplied by the attacker.
In the most reliable test, the recipient opened the link and clicked ChatGPT’s Preview button once. Preview turns HTML, the code used to structure web pages, into a small web page within a conversation. Parameter later configured Preview to open automatically, reducing the required interaction to opening the shared link itself.
Once triggered, the test code ran with the access of the victim’s authenticated ChatGPT session. It listed recent conversations, opened a private chat that had never been shared with the other account and transmitted a small excerpt to a server controlled by Parameter. The researchers conducted this as a controlled proof using separate test accounts, not against unsuspecting users.
The code did not merely copy information visible on the screen. It called ChatGPT’s signed-in APIs directly. An API, or application programming interface, is a route that software uses to request data or actions from another service. Because the code operated with the victim’s web access, Parameter said it was not limited to reading chats and could effectively perform actions on behalf of the account.
ChatGPT normally isolates Preview content inside a sandbox, a restricted area intended to stop untrusted web code from reaching the surrounding service. The Preview ran in a frame, an embedded web page inside another page, on a separate web address. Parameter found that this isolation worked as intended. The escape route instead depended on an interactive graph placed in the same shared conversation.
Rendering that graph loaded MathLive, a mathematics software library, into the main ChatGPT page. MathLive left a listener running there to receive messages related to its on-screen keyboard. Browser frames can exchange messages safely when the receiving code verifies where each message originated. According to Parameter, this listener accepted a keyboard-related message from any sender and permitted it to contain raw HTML as keyboard-layout data.
The isolated Preview could therefore send attacker-supplied HTML across the boundary to the trusted ChatGPT page. That HTML created another frame which the browser treated as belonging to chatgpt.com rather than as isolated content. A script loaded from YouTube then provided the executable code that ran inside this trusted frame.
This final step worked because ChatGPT’s content security policy, a browser rule that limits where a page may load executable scripts from, blocked code written directly into the page but permitted scripts from YouTube. Parameter stressed that the YouTube route was only the last workaround, not the underlying cause. Blocking that source alone would still have left an untrusted Preview able to inject HTML into the main site.
The researchers identified three design decisions behind the chain. MathLive acted on a settings-changing message without verifying which frame sent it. The message could carry raw HTML as keyboard-layout information. That HTML could then create an unsandboxed frame which inherited the chatgpt.com identity.
OpenAI deployed the correction across two versions of ChatGPT’s web frontend, the part of the service that runs in a user’s browser. By October 26, both versions rejected the messages required by the attack. Because the change was made on the service side, ChatGPT users do not need to install an update, reset anything or take another remediation step for this vulnerability.
For organisations assessing risks around web applications and signed-in business accounts, AEU-I provides security-first IT, infrastructure and consulting. The broader lesson from Parameter’s test is that an isolated component can remain secure while a separate trusted component opens an unexpected path around it, making strict checks on the origin and contents of browser messages essential.