A single ChatGPT link could have exposed your private chats

Security researchers showed that a single shared ChatGPT link could have let an attacker secretly read someone's private conversations. The link only had to be opened while the person was signed in. OpenAI fixed the flaw on October 26, 2026. There are no confirmed reports of criminals using it against real ChatGPT customers.

What happened

Researchers at the cybersecurity firm Parameter built a booby-trapped shared conversation. ChatGPT lets people share chats through public links, and the researchers used that feature against itself. When a signed-in test user opened the link, hidden code ran in the background. No password was stolen and no software had to be installed.

In the most reliable version, the person also had to click a Preview button. A later version opened the preview automatically, so opening the link was enough. The researchers reproduced that version three times with a separate test account. In their tests, the code retrieved a private chat that had never been shared with them and sent part of it to a server they controlled.

How it worked

ChatGPT's HTML Preview shows interactive web pages inside a restricted area, a bit like a locked box inside the main page. That lock held at first. The weak spot was MathLive, a tool for displaying math, which the shared graph loaded into the main page. It accepted instructions from other parts of the page without properly checking where they came from.

That let the locked box slip attacker-controlled content into the main page. A script from a YouTube address that ChatGPT's security rules allowed then finished the chain. The code could act with the signed-in user's access, list recent chats and read one.

Who can relax

The fix was made on OpenAI's website, so nobody needed to download an app update. The evidence also comes from controlled tests on test accounts, not from a real attack campaign. The researchers did not show a permanent account takeover, a password change or anyone being locked out.

Parameter reported the problem to OpenAI on October 18. OpenAI reproduced it, raised its severity rating from P2 to P1 on October 21, and paid a $5,000 bounty. Parameter's researcher Mukul Goyal published the findings two days after the fix.

What to do

The steps in the alert box above cover the practical side. In short, treat shared ChatGPT links from strangers like any other unknown link, and think about what sensitive material sits in your chat history.

What happens next

Independent security commentator Simon Willison reviewed the findings on October 31. He pointed to how three separate parts, the restricted preview, MathLive's messaging and an allowed outside script, combined to cause the problem. Each part looked safe alone. Expect similar bugs to turn up elsewhere, since websites are built from many pieces that can interact in unexpected ways.