Parameter disclosed a ChatGPT share-link flaw that read private conversations

Security researchers at Parameter disclosed a ChatGPT share-link flaw to OpenAI’s bug bounty program on Oct. 18, 2026. The flaw allowed attacker-controlled JavaScript to run inside a logged-in visitor’s session and read private conversations. <|constrain|> <|constrain|> <|constrain|>

OpenAI patched the flaw on Oct. 26, 2026, eight days after disclosure. The company initially rated the report P2 before raising it to P1, its highest severity level, and paid Parameter a $5,000 bounty. Parameter released its detailed write-up on Oct. 28, 2026, after OpenAI had already deployed the fix. <|constrain|> <|constrain|> <|constrain|>

ChatGPT’s public sharing feature lets users publish conversations as shareable links. Delivery happened through standard public chat logs sent by e-mail, messaging platforms, help desks, or social media updates. Opening the link was enough; victims needed no installation, workspace membership, or attacker-mediated sign-in. <|constrain|> <|constrain|> <|constrain|>

One proof-of-concept made the victim click ChatGPT’s Preview button once. Another opened Preview automatically, so visiting the link was the only step. Once opened, the code ran inside the visitor’s signed-in session and had the same access as the real ChatGPT site. <|constrain|> <|constrain|> <|constrain|>

The payload displayed recent conversations, opened a private chat the attacker had not seen, and forwarded part of it to a researcher-controlled server. In the test, the researchers sent only a small part of the private conversation data off-site using an image request to a server they controlled. The code called ChatGPT’s signed-in APIs directly rather than scraping visible text, and Parameter said it could perform any action on the victim’s behalf. “Essentially, we could perform any action on behalf of the victim’s ChatGPT account,” the researchers wrote. <|constrain|> <|constrain|> <|constrain|> <|constrain|>

The code pulled the session access token, a digital credential that proves a user has logged in, and the account ID from the page for authenticated API calls. The main API requests targeted the conversation list endpoint and a specific conversation detail endpoint. <|constrain|> <|constrain|>

Parameter ran the private-chat test between separate accounts and said it saw no real-world exploitation. Parameter confirmed the automatic attack path three times using a separate account, even after a hard refresh, with the alert appearing about 4.5 seconds later. <|constrain|>

The first version used a researcher-controlled ChatGPT App as the sender, requiring the victim to connect or invoke that App first. Parameter merged a genuine graph with an assistant-authored HTML Preview inside one public conversation so the share link preserved the full attack chain. <|constrain|>

The attack linked ChatGPT’s Preview feature, a tool that renders HTML blocks inside a separate frame, to an interactive graph that loaded the MathLive library into the main page. MathLive placed a message listener on the main ChatGPT page that accepted keyboard messages from any sender and permitted raw HTML in those messages. HTML from outside crossed from the Preview container into the secure primary document, creating an unisolated window that kept the chatgpt.com privileges. <|constrain|> <|constrain|> <|constrain|>

ChatGPT’s content security policy, a browser rule that limits which scripts can run on a page, blocked inline scripts but allowed scripts from YouTube. The attackers used YouTube’s oEmbed endpoint, a service that lets a site embed content from another platform, as a workaround to run JavaScript. Parameter identified three contributing factors: MathLive processed configuration updates without checking the origin, keyboard-layout payloads allowed raw HTML injection, and that HTML created an unconstrained frame sharing the chatgpt.com origin. <|constrain|> <|constrain|> <|constrain|>

Parameter said blocking YouTube by itself would not remove the root cause because an untrusted Preview could still inject HTML into the main site. The Preview sandbox itself worked because code inside it could not read the main ChatGPT page directly. <|constrain|>

OpenAI confirmed the exploit and private-chat demonstration, raised the rating from P2 to P1, and patched two versions of the ChatGPT web frontend. By Oct. 26, 2026, both frontend versions blocked the cross-frame MathLive messages needed for the attack. <|constrain|>

Users needed no action because OpenAI deployed the fix on the server side with nothing to install or reset. Parameter and OpenAI’s coordinated response means users face no required update or account reset. <|constrain|> <|constrain|>

OSINTSights said defenders should watch frame-message listeners that skip origin checks and functions that allow unvetted HTML to cross trust levels. The outlet also said companies using SaaS collaboration features should check vendor fixes and frontend versions because shared links can be a practical risk path even without installation or credential handoff. <|constrain|> <|constrain|>