A shared ChatGPT link could run attacker code and read private chats; OpenAI has fixed the flaw

Researchers at security firm Parameter have published details of a now-fixed ChatGPT vulnerability: an ordinary-looking public share link could run attacker-controlled JavaScript inside the signed-in session of whoever opened it. The Hacker News reported on the findings this week.

What the attack could do

In Parameter’s controlled tests, the code ran as chatgpt.com and could:

• list the victim’s recent conversations;
• open a private chat never shared with the attacker;
• send part of it to an external server controlled by the researchers.

The researchers say the code could essentially act as the victim on the site. Opening the link was the only step required.

Root cause

According to Parameter, three design choices lined up: the MathLive math-input component accepted a settings-changing message without checking which frame sent it; that message could carry raw HTML; and the HTML could create an unsandboxed frame that inherited ChatGPT’s identity, slipping past the sandboxed Preview feature.

Timeline

• 18 October 2026 — reported via OpenAI’s bug bounty.
• OpenAI reproduced it and raised the severity from P2 to P1, its most serious category.
• 26 October — fix deployed; Parameter published its write-up on 28 October.

Parameter reports no evidence of real-world exploitation; its proof ran between its own test accounts. Users do not need to do anything — the fix is on OpenAI’s side.