Researchers show a shared ChatGPT link could run attacker code and read private chats

A single malicious ChatGPT share link could have been enough to run an attacker's code in a victim's ChatGPT session and read conversations the victim never shared, according to research published by security firm Parameter and reported by The Hacker News on October 31, 2026. The researchers said they found no evidence of real-world exploitation and tested the attack using separate accounts, and OpenAI has since fixed the issue.

What happened

According to The Hacker News, Parameter reported the flaw through OpenAI's bug bounty program and demonstrated it in a controlled test. An attacker would share an ordinary ChatGPT conversation using its public share link and deliver that link by email, chat, support ticket, or social post. In the initial version, the victim only had to open the link and click "Preview" once; in a later version, Parameter made the page trigger Preview automatically, so simply opening the link was enough.

Technical details

The researchers said the attack chained several design issues. ChatGPT's Preview feature loaded an interactive graph that pulled in the MathLive math library. MathLive acted on incoming browser messages without verifying the sender, and those messages could carry raw HTML. That HTML could create a frame that was not sandboxed and that inherited the chatgpt.com identity. ChatGPT's content security policy blocked inline scripts but allowed scripts loaded from YouTube, which the researchers used as a final workaround to get their code running. Once executing, the code ran with the victim's full web access: in the demonstration it listed recent conversations, opened a private chat that had never been shared with the attacker, and sent part of its contents to a server the researchers controlled. Parameter said the code could act on the victim's account more broadly.

Who is affected

The issue affected the ChatGPT web frontend before OpenAI's fix. Because the attack required only that a victim open a shared link, anyone who received such a link from an attacker could have been targeted, which is a wide population given ChatGPT's scale. The Hacker News reported no known real-world abuse, and the researchers emphasized the demonstration was conducted responsibly.

What to do

Parameter said OpenAI reproduced the issue, raised its internal severity from P2 to P1, and patched two versions of the ChatGPT web frontend. By October 26, both versions rejected the browser messages the attack depended on. Because the fix is server-side, users do not need to install or reset anything. The case is nonetheless a reminder that opening shared links from untrusted sources carries risk, and that browser-based message passing and permissive content security policies can combine into a full account-takeover chain. OpenAI paid Parameter $5,000 for the report, and Parameter published its writeup on October 28, 2026. The report does not mention a CVE identifier.