NEWS

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

Parameter researchers chained three design flaws so a shared ChatGPT link could run code in a victim's session. OpenAI fixed it server-side.

Dylan H.

Security Team

October 31, 2026
3 min read
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

Overview

Researchers at security firm Parameter showed that a malicious ChatGPT conversation, shared through its public link, could run an attacker's code in the logged-in session of anyone who opened it. The victim only needed to open the link and click Preview once. A later variant opened Preview automatically.

OpenAI has fixed the issue server-side, so users do not need to install or reset anything. Parameter reported no real-world exploitation.

How the Attack Worked

The attack chained three design flaws:

  1. MathLive, a math library loaded by an interactive graph in the shared chat, listened for keyboard-settings messages without checking the sender.
  2. That listener accepted raw HTML, letting the sandboxed Preview push HTML into the main ChatGPT page.
  3. The injected HTML created an unsandboxed frame that inherited the chatgpt.com identity. A script loaded from YouTube, which ChatGPT's content security policy allowed, supplied the code that ran there.

Once running, the code had the victim's full web access. It could list recent conversations, open a private chat never shared with the attacker, and send part of it to an external server. Per the researchers, it could perform any action on behalf of the victim's account.

Timeline

DateEvent
Oct 18, 2026Parameter reports the flaw through OpenAI's bug bounty program
About Oct 26, 2026OpenAI deploys fixes to two web frontend versions, raising severity from P2 to P1
Oct 28, 2026Parameter publishes its writeup

OpenAI paid a $5,000 bounty. The YouTube script step was only a workaround for the CSP, so blocking it alone would not have closed the underlying problem.

Why It Matters

  • Shared-content features that render interactive code are a recurring attack surface for AI chat products.
  • Message handlers that skip sender checks (postMessage without origin validation) turn a sandbox into a bridge.
  • Allowlisted third-party hosts in a CSP can still serve attacker-controlled scripts.

Recommendations

  1. Be cautious with shared AI-chat links from unknown senders, especially ones that ask you to click Preview or run an interactive element.
  2. If you build apps that embed sandboxed content, validate message origin and never accept raw HTML across the sandbox boundary.
  3. Review CSP allowlists for hosts that permit user-supplied script.

Sources