A researcher at security firm Parameter showed that a shared ChatGPT link could run attacker code inside a victim’s signed-in session and pull out a private conversation. OpenAI fixed the ChatGPT shared link flaw on October 26, 2026, and rated it P1, its most serious category.
The fix is server side, so there is nothing to install or reset. Still, the way this worked says a lot about how much trust a “share” button quietly asks you to extend.
TL;DR: Parameter Labs found that opening a malicious shared ChatGPT conversation could run attacker JavaScript as chatgpt.com in your session. The demo listed recent chats and exfiltrated a private one. OpenAI fixed it on October 26 and paid a $5,000 bounty. No real world abuse was reported, and you need to do nothing.
How the ChatGPT shared link flaw worked
Parameter’s write-up by Mukul Goyal describes an attacker who publishes a ChatGPT conversation containing a genuine interactive graph and an assistant-written HTML Preview. Sharing the conversation was enough. The attachment on its own did nothing.
Imagine getting that link in a support ticket or a group chat. It looks like any other shared conversation, and you open it because that is what shared links are for.
In the most stable test, the victim clicked the normal Preview button once. In a later version, Parameter marked the HTML block as previewable so it opened automatically, and the write-up says opening the link was the only required action. That detail is the one that turns a trick into a real risk.
The chain behind the bug
ChatGPT’s Preview feature renders HTML in a sandboxed frame, and that sandbox held. The trouble came from the graph. According to Parameter, drawing it loads the MathLive math library into the main ChatGPT page, which installs a message listener.
That listener used an origin policy of “none,” so it accepted messages from any sender. The sandboxed Preview sent two messages, one to swap the virtual keyboard layout for attacker HTML and one to display it. Parameter notes the layout markup went into innerHTML, and the helper meant to guard it was an identity wrapper, not a sanitizer.
The injected HTML created a frame with no sandbox attribute, so it inherited the chatgpt.com identity. ChatGPT’s content security policy blocked inline scripts but allowed YouTube, and Parameter used a YouTube endpoint that reflects a callback parameter to get script running. The YouTube step was a workaround, not the root cause.
In Parameter’s own words, “CSP is valuable defense in depth, but it cannot make an unsafe rendering path safe.” That is the detail most coverage will skip, and it is the real lesson for anyone building a chat product.
What the researchers showed, and what they did not
In the demo, the payload read session data from the parent page and called ChatGPT’s conversation APIs as the victim. It listed recent conversations, retrieved a private chat that had never been shared with the attacker, and sent a selected value to an external server through an image request. Parameter says the same access could allow other actions as the victim, which it describes as essentially taking over the account.
It did not report any exploitation outside its own testing, and it does not name the two affected versions of ChatGPT’s web frontend. Here is the timeline from the write-up.
| Date | Event |
|---|---|
| October 13, 2026 | Parameter confirms the issue against production code |
| October 18, 2026 | Report submitted to OpenAI |
| October 21, 2026 | Severity raised from P2 to P1 |
| October 26, 2026 | OpenAI confirms both frontend versions reject the attack messages |
| October 28, 2026 | Parameter publishes its write-up |
Eight days from report to fix is quick for a chain with this many moving parts. Parameter also says OpenAI paid a $5,000 bounty in total.
What this means for the links you open
You do not need to change a setting or install anything. The fix lives on OpenAI’s side, and Parameter says both affected frontend versions now reject the cross-frame messages.
The larger point is about what your account holds. If you use ChatGPT for work drafts, health questions or locked chats, a signed-in session is a rich target, and the memory study findings show how much of that history ChatGPT writes itself.
Until the next bug like this one, the sensible habit is simple. Treat a shared AI conversation the way you treat an unfamiliar attachment, and open links from people you actually know.
