The ChatGPT shared link flaw let a crafted link run an attacker’s code inside your logged-in ChatGPT session and read chats you never shared. OpenAI fixed it on October 26, and the fix is server-side, so you don’t need to update or reset anything.
Security firm Parameter found the bug and published its writeup on October 28, after the patch was live. Here’s what happened and what it means for how you open shared AI links.
The key facts at a glance:
- Reported to OpenAI on October 18, 2026; fixed on October 26.
- OpenAI rated it P1, its most serious level, and paid a $5,000 bounty.
- Needed only a malicious
/sharelink, and later one visit was enough. - No reports of attacks on real users, and no action is required from you.
That list is the short version. The details below show why this one got a top severity rating.
How one ChatGPT share link could take over a session
The attack started with an ordinary public share link. The shared conversation contained an HTML Preview and an interactive graph. According to ShiftDelete, Preview runs HTML in an isolated frame on a separate domain, and that sandbox held up.
The weak spot was the graph. It loaded the MathLive math library into the main ChatGPT page, and MathLive listened for messages from any sender. Those messages could carry raw HTML.
The researchers used that gap to push HTML out of the sandbox and into a frame the browser treated as part of chatgpt.com. ChatGPT’s security policy already allowed scripts from YouTube, so they abused a YouTube endpoint to run their own JavaScript there.
As the researchers put it, per AI Weekly, a message passed between browser frames is safe only if the receiver checks who sent it. MathLive didn’t check.
What an attacker could do once the code ran
In Parameter’s test between two separate accounts, the injected code listed the victim’s recent conversations. It then opened a private chat that was never shared and sent part of it to a server the researchers controlled.
Parameter said the code could perform any action on the victim’s ChatGPT account. That includes calling the same authenticated APIs the site itself uses.
The first version needed one extra click on Preview. A later version opened Preview automatically, so visiting the link was the only step. No install or sign-in through the attacker was needed.
ChatGPT shared link flaw timeline: report to fix in 8 days
OpenAI moved fast once it had a working demo. Here’s the sequence, based on the dates in the reports.
| Date (2026) | What happened |
|---|---|
| October 18 | Parameter reports the issue to OpenAI. |
| October 21 | OpenAI reproduces the attack and raises severity from P2 to P1. |
| October 26 | Fixes ship across two versions of the ChatGPT web frontend. |
| October 28 | Parameter publishes the full technical writeup. |
The quick turnaround matters because the bug sat in the page itself, not in your device. That is also why the fix reached everyone at once.
Why the sandbox did not save ChatGPT
The most interesting part is that the safety design mostly worked. OpenAI put risky HTML in a separate, isolated frame, which is exactly what you want. The attackers never broke that wall directly.
Instead, they found a trusted piece of the main page that would take instructions from the sandboxed side. That is a common pattern in browser security: the isolation is fine, but a helper library on the trusted side opens a door.
It also shows how three small problems can add up. A loose message listener, a frame that inherits trust, and an allowed script source were each minor alone. Chained together, they reached P1.
For you as a user, the practical lesson is simple. AI chat apps now render graphs, previews, and mini apps, which means a shared conversation is closer to a web page than a text file.
Do you need to do anything?
No. Both reports say the fix is server-side, and neither describes attacks on real users. The only proof-of-concept runs were by the researchers, and OpenAI reproduced them.
Still, it’s a good reminder to treat shared AI links like any unfamiliar link. If you want an extra layer for sensitive chats, our guide to ChatGPT locked chats covers the PIN option. Connecting other apps? See how the ChatGPT iCloud plugin works first.
If you run a team, the editor’s note at AI Weekly suggests auditing which third-party widgets your AI apps load into their own pages. A single library with loose message handling was enough here.
Frequently Asked Questions
Is the ChatGPT shared link flaw fixed?
Yes. OpenAI shipped the fix on October 26, 2026. It is server-side, so you don’t need to update an app or change your password.
Were my ChatGPT chats exposed?
The reports don’t mention any attacks on real users. Only the researchers’ proof-of-concept tests are described.
Is it safe to open ChatGPT share links now?
This specific bug is closed, so the risk is much lower. Treat links from strangers with normal caution, since shared AI pages can run interactive content.
Who found the bug?
Security firm Parameter reported it on October 18. OpenAI paid a $5,000 bounty through Bugcrowd.
My take: you can relax about this one, but keep the habit. A patched bug doesn’t change the fact that a chat link is a web page, and web pages can carry surprises. Open links from people you know, and keep anything truly private out of chats you plan to share.
Leave a Reply