Researchers showed a booby-trapped ChatGPT share link could read a signed-in user's private chats. OpenAI has fixed it, and users need to do nothing.
A shared ChatGPT link could have been turned into a trap. Researchers at the security firm Parameter showed that a booby-trapped link could run an attacker's code inside the signed-in session of anyone who opened it, and read their private conversations. OpenAI has fixed the flaw.
The trap looked like an ordinary shared chat. It could be sent the way any real shared chat is sent: by email, a chat message, a support ticket or a social post. The victim did not have to install anything or sign in through the attacker.
In the most reliable version, the victim opened the link and clicked ChatGPT's Preview button once. In a later version, the researchers made Preview open on its own, so opening the link was the only step.
Once it ran, the code had the same access as the real ChatGPT site. It listed the victim's recent conversations, opened a private chat that had never been shared, and sent a small portion of it to a server the researchers controlled. The researchers wrote that they could perform any action on behalf of the victim's account.
Preview turns a block of HTML in a chat into a small web page. ChatGPT runs it in a locked-down frame so it cannot read the main page around it. That lock held.
The way in came from a second feature. A graph in the same chat loaded a math library called MathLive into the main page. It left behind a listener that accepted keyboard messages from any sender, and those messages could carry raw HTML. That let the Preview hand attacker HTML to the trusted page. A script loaded from YouTube then supplied the code.
ChatGPT users do not need to do anything. The fix is on OpenAI's side, with nothing to install or reset. By October 26, both affected versions of ChatGPT's web frontend rejected the messages the attack relied on. Parameter reports no real-world abuse. Its private-chat proof ran between separate accounts, not against real users.
The lesson is about habits. A link that looks like a normal shared chat deserves the same care as any other link, especially from someone you do not know. The steps in the alert box above cover what to do.
Parameter reported the flaw through OpenAI's bug bounty program on October 18. OpenAI reproduced it, raised the severity from P2 to P1, its most serious category, and fixed it eight days after the report. Parameter published its writeup on October 28, and OpenAI paid a total of $5,000 for the find.
No action is needed, but treat shared chat links from strangers like any other link, and skip Preview on chats you do not trust.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone number
