A malicious ChatGPT shared link could run an attacker's code inside the signed-in session of anyone who opened it, letting them list and read that person's private conversations, security firm Parameter has disclosed. The researchers reported the flaw to OpenAI on October 18 and published their full technical writeup on October 28, after the fix was live. 'Essentially, we could perform any action on behalf of the victim's ChatGPT account,' Parameter wrote of its controlled test between separate accounts.

The trap was an ordinary public conversation shared with the same /share link anyone can create — no install, workspace or fake sign-in page needed. The chain combined two features in one chat: the HTML Preview, which runs in an isolated frame, and an interactive graph whose MathLive library left a listener on the main ChatGPT page accepting messages from any sender. Attacker HTML pushed through that gap created an unsandboxed frame the browser treated as part of chatgpt.com, and because ChatGPT's content policy allowed YouTube scripts, a YouTube oEmbed endpoint was abused to run the attacker's JavaScript. The reliable version needed one click on Preview; a later version triggered on simply visiting the link.

OpenAI reproduced the attack on October 21, raised its severity from P2 to P1 — its most serious level — and had fixes live across two versions of ChatGPT's web frontend by October 26, paying a $5,000 bounty through Bugcrowd. There is no report of the bug being used against real users, the fix is server-side, and ChatGPT users do not need to do anything.