Shared ChatGPT link flaw could hijack accounts

What the shared ChatGPT link flaw allowed

Opening a malicious shared link let the creator's code run in the viewer's ChatGPT session, read private chats and send them to an outside server. Parameter published the details on October 28, 2026, after testing the attack between its own accounts.

The setup was ordinary. An attacker would build a conversation, publish it with ChatGPT's normal share button and send the link by email, chat, a support ticket or a social post. A different kind of hijack, aimed at AI coding agents, is covered in AGENTS.md in Downloads hijacks AI coding agents.

Opening the link was the only step needed

The victim did not need to install anything or join a workspace, and in the final version did not even need to click Preview. Preview is the ChatGPT feature that turns a block of HTML in a chat into a small working web page.

Parameter tested two versions. The more reliable one needed a single click on that button after the link opened. A later version marked the HTML so ChatGPT previewed it on its own, and Parameter reproduced that path three times in a separate account, with a test alert appearing after roughly 4.5 seconds.

The code ran as the signed-in user

Because the code called ChatGPT's own account features as the victim, Parameter says it could do almost anything in that account. It was not limited to changing what appeared on the screen.

In Parameter's test, the code pulled the 20 most recently updated conversations, opened one private chat and sent part of it to a server Parameter controlled. Anyone who keeps work notes, drafts or personal questions in ChatGPT would have had that history exposed to the link creator.

How a math library opened a path out of Preview

Preview's isolation held, but a math library loaded for a graph in the same chat accepted messages from Preview and let them reach the main ChatGPT page. ChatGPT runs Preview content on a separate web address, so a preview cannot read the signed-in page around it.

When a chat also contains a graph, ChatGPT loads a math library called MathLive into the main page. MathLive listens for messages about its on-screen keyboard. A preview could send it one of those messages, and that was the bridge Parameter used.

The keyboard listener did not check the sender

MathLive accepted a keyboard layout containing HTML from any page and inserted it into the ChatGPT page, where Parameter used it to add a frame with no sandbox. Browsers treated that frame as part of chatgpt.com, with the same access as the real site.

ChatGPT's security settings blocked most outside scripts, but they allowed scripts from YouTube. Parameter used a YouTube response to slip its own code past that rule, and the code then ran with full access to the account.

Each feature looked reasonable on its own

Parameter says the flaw appeared only when Preview, graphs, frame messaging, the YouTube allowance and public sharing were combined in one page. None of them looked wrong by itself, so testing each feature alone would not have revealed the gap.

Parameter also stresses that YouTube was only the last step around ChatGPT's script rules. The root problems were a listener that trusted any sender, a keyboard setting that could carry HTML, and HTML that could create a frame with no sandbox, which the browser treated as chatgpt.com.

How OpenAI fixed the flaw and rated it P1

OpenAI reproduced the issue on October 21, raised it from P2 to P1 and paid a $5,000 bounty after both web versions were fixed. The fix was made on OpenAI's side, and Parameter's report does not ask users to update anything.

Timeline from report to fix

Parameter reported the flaw on October 18, and OpenAI had both versions of its web app fixed by October 26. The steps below come from the timeline in Parameter's report, plus its publication date.

From discovery to fix (Parameter's timeline)

Date	Event
October 13	Parameter confirms the MathLive-to-HTML path in ChatGPT's live code
October 14	Chain reproduced through the normal interface, reaching arbitrary JavaScript
October 16	Attack confirmed between separate accounts through a public share, with one Preview click
October 17	Automatic Preview confirmed when the shared link opens
October 18	Report sent to OpenAI's bug bounty program
October 19	Proof added that private chat content could leave the session
October 21	OpenAI reproduces the issue and raises it from P2 to P1
October 22	One of two web frontends fixed
October 23	Script-rule changes block part of the chain
October 26	Both frontends fixed, issue resolved, $5,000 bounty paid
October 28	Parameter publishes the details

ChatGPT's web app runs in two versions, and one was still being updated after the first fix on October 22. Parameter published its report on October 28, after both versions were fixed.

The report does not say whether anyone was attacked

Parameter's write-up covers its own tests and the fix, with no statement on whether real users were targeted before October 26. It describes what the code could reach in Parameter's accounts and how OpenAI responded.

During testing, Parameter sent only a small piece of each response off-site on purpose. It notes that the code had already received the full conversation, so the exposure was not limited to what it sent. Whether anyone else found the same path first cannot be judged from the report.

Steps to protect your ChatGPT chats now

The fix closes this hole, but chats stored in ChatGPT and links from strangers remain the two places where people can limit their exposure. Two government agencies cover those two points: the UK's National Cyber Security Centre (NCSC) on what to keep out of AI chatbots, and the US Cybersecurity and Infrastructure Security Agency (CISA) on what to do with suspicious links.

Companies: set rules for what goes into ChatGPT

The UK's NCSC advises against putting sensitive information into public AI chatbots, because the provider stores what users type. It adds that stored queries could be hacked, leaked or made public by accident.

This flaw showed a second route to the same data: anyone who could run code in your session could read your chat history. A short company rule on what staff may paste into ChatGPT, such as no customer records and no unreleased plans, limits what any future leak could expose.

Employees: check unexpected links before opening them

This link pointed to a real chatgpt.com page, so the address alone could not show it was safe. The safer habit is to ask why someone sent it before you click.

CISA advises against clicking any link in a message you are unsure about. If the message might be genuine, contact the sender another way, for example through a phone number you already have or the company's verified website.