The Pulse
OpenAI Fixed ChatGPT Share-Link Flaw That Exposed Private Chats
Parameter researchers reported that a public ChatGPT share link could run code in a recipient’s signed-in session and access private conversation data. Parameter says OpenAI fixed the issue on October 26, 2026, and classified it as P1.
AI.info Team · Written with AI · fact-checked ·
ChatGPT’s code Preview was meant to keep user-written web pages away from the signed-in service, but Parameter researchers found a path around that boundary through an ordinary public share link. Parameter’s account says OpenAI reproduced the researchers’ demonstration, raised the report’s severity to P1 and fixed the issue on October 26. Parameter published its technical account on October 28.
One shared conversation crossed the boundary
The attack combined two ChatGPT features that appeared unrelated: an interactive graph and an HTML Preview. The graph loaded MathLive, a library that installed a message listener in the main ChatGPT page; the Preview ran in a separate, restricted frame. Parameter found that the listener accepted messages without checking which frame sent them, and that the messages could carry HTML.
That HTML could create a new frame without a sandbox. Because the main ChatGPT page created it, the browser treated it as part of chatgpt.com, giving its code access to the signed-in page. ChatGPT’s content security policy blocked inline scripts but allowed scripts from YouTube; Parameter used a YouTube endpoint’s JSONP callback behavior to run code through that permitted route.
The researchers combined the graph and Preview in a single public conversation, then tested the resulting share link between separate accounts. In one version, the recipient had to click Preview once; in a later version, Preview opened automatically. Parameter says opening the link was then the only user action required.
“The victim did not need to install an App, join a Project, paste code, or open developer tools. Opening the shared link was the only required action.”
Mukul Goyal, author of the Parameter report
Researchers demonstrated access to private conversations
Parameter says the injected code could list a victim’s recent conversations and request message data from a private chat that had never been shared with the attacker. The researchers’ proof used separate test accounts, and they sent only a small selected part of the response to a server they controlled. They did not describe the demonstration as evidence that attackers had used the flaw against real users.
The code called ChatGPT’s authenticated APIs rather than merely reading text displayed on screen. Parameter wrote that the exploit could perform actions available through the victim’s account, though its reported demonstration focused on retrieving private conversation data. The distinction matters: the researchers showed a capability in a controlled test, not a record of account theft in the wild.
OpenAI patched both web frontends
Parameter’s timeline says it reported the issue to OpenAI’s bug bounty program on October 18. OpenAI reproduced the JavaScript execution and private-conversation proof, then raised the severity from its initial P2 triage to P1 on October 21. The company rolled out fixes across two versions of ChatGPT’s web frontend, completing the work on October 26.
The researchers traced the exploit to three connected weaknesses: MathLive’s listener accepted a state-changing message without verifying its sender; the message could contain raw HTML; and that HTML could create an unsandboxed frame with ChatGPT’s web identity. Parameter says the final YouTube step was a workaround for the site’s content security policy, not the underlying flaw. Blocking that endpoint alone would not have removed the unsafe path for HTML to reach the main page.
The fix is on OpenAI’s side
Parameter says OpenAI confirmed on October 26 that both frontend versions rejected the messages used in the report, and awarded a total bounty of $5,000. The issue was fixed before Parameter published its write-up two days later.
The finding turned on how features interacted, rather than a failure of the Preview sandbox by itself. Preview code could not directly read the surrounding ChatGPT page; an unverified message listener in that page provided the bridge. Parameter’s report documents how a graph, a previewed page, an HTML rendering path and an allowed script source combined to make a public share link run code in a user’s authenticated session.