Researchers showed that opening a shared ChatGPT link could let an attacker read private chats. OpenAI says it fixed the flaw on October 26.
A research team has shown that one shared ChatGPT link was enough to take over someone's account. Opening the link was the only step. OpenAI fixed the flaw on October 26 and rated the report P1, its top-priority tier. The team published its findings on parameter.ai.
ChatGPT lets you publish a conversation and share it by link. The researchers built a conversation designed to be malicious, shared it, and sent the link to a test victim. When the victim opened it, the attacker's code ran inside the victim's signed-in ChatGPT session on chatgpt.com.
The team says that code could list the victim's conversations and read a private chat that had never been shared. It could also send that chat's contents to an outside server. It could act as the victim inside ChatGPT, which is why the researchers call it an account takeover.
No single feature was broken. The attack chained several small gaps. ChatGPT can turn a block of code into a small working webpage, called Preview, and it runs that page in a walled-off space so it cannot touch the main page. A graph in the same conversation loaded a math tool called MathLive, which listens for messages in the main page.
The researchers say that tool did not check who sent a message. The walled-off Preview could pass one through, and the main page then built content from it. A YouTube feature that ChatGPT's security rules allowed helped the researchers get around a further safeguard. The published write-up is cut off before its final step, so the full chain is not covered here.
The people at risk were those who use ChatGPT on the web and opened a shared conversation link. That includes business users with private chats and files in their accounts. The researchers say the victim did not need to install an app, join a Project, paste code or open developer tools.
The material does not say whether anyone used this method against real users before the fix. It also does not say whether OpenAI has sent notices to customers. The report describes the researchers' own tests. The fix date of October 26 comes from the researchers' account.
The alert box above lists the steps. The main idea is to treat a shared chat link like any link from a stranger, and to clear sensitive details out of old chats.
Watch for any statement from OpenAI about the issue. The bigger lesson is that shared AI chats can hold private work and personal details. A link to one deserves the same caution as any other link.
Treat shared ChatGPT links like any link from a stranger, and delete sensitive details from old chats you no longer need.
EA has re-released 25 classic PC games at a discount until November 19, and Bethesda has finally given The Elder Scrolls VI a subtitle: Sentinel.
Read more: EA brings 25 classic PC games back, and Elder Scrolls VI gets a nameA user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesOpenAI released a ChatGPT for analysts and bankers that shows where each number came from, a feature that could matter well beyond finance.
Read more: OpenAI launches a ChatGPT built for Wall Street analysts
