BUSINESSDevelopments · · 2 min read · Source: Parameter
ChatGPT: A shared link could expose private chats
Security firm Parameter has disclosed a ChatGPT flaw that let a crafted shared chat run code inside a victim's signed-in session. According to Parameter, OpenAI closed it by October 26, 2026, and the researchers report no real-world attacks.
Key facts
- Parameter reported the flaw to OpenAI on October 18, 2026, and published the details on October 28.
- According to Parameter, the flaw has been closed since October 26, 2026; the bounty was $5,000.
- The researchers read a never-shared chat in test accounts and report no real-world attacks.
What was possible
Parameter reported the issue through OpenAI's bug bounty program on October 18, 2026. Using its own test accounts, the team was able to:
- list the victim's recent conversations,
- open a private chat that had never been shared,
- send selected content to an outside server.
The code could also call ChatGPT's APIs as the victim, which is why Parameter describes the result as essentially an account takeover.
How the attack worked
The link could have arrived by email, chat message, support ticket or social post. In the most reliable version, the victim opened the link and clicked Preview once. The researchers later showed that Preview could open on its own, so opening the link was enough.
Technically, several weaknesses lined up: a component used to display math accepted messages from any sender, those messages could carry raw HTML, and that produced a frame without the usual isolation. The Preview sandbox itself held.
How quickly OpenAI responded
- October 18: reported to OpenAI.
- October 21: severity raised from P2 to P1.
- October 22 and 23: fixes rolled out to two web frontends.
- October 26: OpenAI confirmed the work was complete.
- October 28: Parameter published the details.
The bounty came to $5,000. The fix was made server-side, so there is nothing to install.
What remains
The flaw itself is gone. The pattern is the useful part: a link to a familiar address looks harmless, and that is exactly what makes it attractive to attackers. Checking the address alone isn't enough, especially when the message arrives unexpectedly.
What this means for you
- You don't need to do anything: OpenAI closed the flaw on its own servers.
- A familiar domain doesn't prove a link is safe. Links to well-known AI services can carry someone else's content.
- The more work sits in your AI chats, the more your account is worth. Treat it like your email inbox.
How to use this
There's nothing to do about the flaw itself. Use it as a prompt to secure your ChatGPT account as well as your email and to set a short team rule for shared chat links from outside.
Luigi's take
For me, the flaw isn't the main story. Bugs like this happen, and this one was handled cleanly: reported, triaged, closed in just over a week, then described openly. What interests me more is what it says about our habits. Plenty of people now keep drafts, figures and customer questions in their AI chats, yet protect that account less carefully than their inbox.
My advice for small teams: decide what belongs in an AI chat and what doesn't. And agree on how to handle shared chats from outside. Anyone who gets one unexpectedly checks with the sender before clicking. It takes a minute, and it works for every other link as well.
FAQ
Do I need to do anything as a ChatGPT user?
No. The fix was made on OpenAI's servers, so there is nothing to install or reset.
Was the flaw used in real attacks?
Parameter reports no real-world attacks. The tests ran on the researchers' own accounts.
Source
Parameter: We found a gap at OpenAI
More sources
- The Hacker News – Bericht vom 31. Oktober 2026 mit Ablauf und technischen Details
This article was researched and written with AI assistance. Responsible: Luigi Lugmayr.
