A crafted ChatGPT shared link could run code in the session of whoever opened it and read their private conversations. Security firm Parameter found it and published the details on October 28, 2026; OpenAI had fixed it on October 26. ChatGPT users have nothing to install.
What we know
- Who found it: Parameter, in «Do the Math: How We Took Over ChatGPT Accounts», by Mukul Goyal, published October 28.
- Timeline, per Parameter: it reported the issue to OpenAI's bug bounty program on October 18. OpenAI reproduced it on October 21 and raised its severity from P2 to P1. On October 26 it confirmed that both ChatGPT web frontends rejected the attack, closed the report and paid a total bounty of $5,000.
- What it allowed: per Parameter, opening the shared chat was enough; in the final version of the attack the preview opened on its own. The code could act as the victim: in its test it listed their conversations, read a private one that had never been shared, and sent a value to an outside server.
- How it got in: ChatGPT's sandboxed preview held. The gap came from combining pieces: a math-formula library (MathLive), loaded by a graph in the chat, accepted messages from other windows without checking who sent them and allowed HTML; that HTML could create an unsandboxed frame carrying the chatgpt.com identity; and the Content Security Policy (CSP) allowed code from a third-party domain.
- What isn't known: Parameter reports no real-world abuse; its tests used its own accounts. No OpenAI note has been located, so the timeline is Parameter's.
What changes and what doesn't
- If you use ChatGPT, there is nothing to do: the fix is on OpenAI's side, not on your device.
- Still true: a shared chat is someone else's content. Treat it with the same care as an attachment.
- If you build websites, the lesson is about design. No single piece was enough; the flaw came from combining them on a signed-in page.
How to tell if you're affected
If your business uses ChatGPT:
- Review your shared links in ChatGPT's settings, under shared links, and delete the ones you no longer need.
- Agree with your team not to share chats containing customer or company data by link.
If your site loads third-party widgets, iframes or libraries (support chat, editors, maps, formulas, payments):
- Find your message listeners (`addEventListener('message'`) and make sure each one checks the message origin before acting. Parameter recommends checking both the origin and the exact window that sent it.
- Never turn content from another window into HTML: treat it as text.
- Add the `sandbox` attribute to iframes whose content you don't fully control.
- Review your CSP: every domain allowed to load scripts is one more way in. Parameter notes that CSP is an extra layer, not the only one.
- Start with signed-in pages (customer area, dashboard, store): that is where a flaw like this exposes data.
Related: Fake ChatGPT, Gemini and Claude Ad Portals Target Ad Accounts
Sources
- Parameter, «Do the Math: How We Took Over ChatGPT Accounts», Mukul Goyal, October 28, 2026
- The Hacker News, «A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats», October 31, 2026
Updates: if OpenAI publishes its own note or real-world abuse is reported, it will be added here with a link.