Researchers Show Shared ChatGPT Links Could Expose Private Chats

A vulnerability in ChatGPT allowed a shared chat link to execute attacker-supplied code within the recipient’s signed-in session, enabling the attacker to access private conversations. Researchers from Parameter demonstrated that when a user opened a public chat link, the attacker’s code could run with the victim’s ChatGPT privileges, listing recent conversations, opening a private chat not shared with the attacker, and sending a portion of it to a server under the attacker’s control.

The exploit did not require installation, workspace joins, or sign-in, and in one reliable variant only required the user to click the Preview button after opening the link. Parameter notes that the attack acted by invoking ChatGPT’s own signed-in APIs rather than simply reading the on-screen content, meaning it could act on behalf of the victim’s account. No real users were harmed during the researchers’ tests, which were conducted privately across separate accounts.

OpenAI patched the flaw within eight days of a vulnerability report submitted on 18 October, elevating its severity to P1, the most serious category. The chain of failure involved three design choices: a MathLive component loading a library via a message that could change settings without frame-origin checks; HTML being carried as keyboard-layout data; and the ability for an unsandboxed frame to inherit the chatgpt[.]com identity, allowing attacker HTML to reach the main page.

A YouTube-sourced script then completed the attack in the main page context. OpenAI’s fix reportedly applied to two frontend versions by 26 October, and Parameter published its write-up on 28 October. The researchers state that ChatGPT users do not need to take action, as the fix was implemented on the vendor side.