NewsCompaniesFlawsGuides
Get the app

ChatGPT: opening someone's shared chat could hand them your private ones, until a fix on 26 October

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

Parameter, a security firm, says a chain of small gaps in ChatGPT's shared chats, its HTML preview and a maths library let a public share link run code as chatgpt.com in the visitor's own signed-in session. In its tests, that code listed the visitor's conversations, read one never shared, and sent part of it out. OpenAI rated it P1, fixed it on 26 October and paid a US$5,000 bounty, according to Parameter's write-up. Nobody has reported it being used against real people.

Security researchers found that opening a booby-trapped ChatGPT share link could let whoever made it read your private conversations and act as you. OpenAI has fixed it. The bigger question is what your chat history would tell a stranger.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

ChatGPT lets you share a conversation as a public link. Security researchers at Parameter found that, until a few days ago, opening the wrong one could do much more than show you someone else's chat. It could run their code inside your own ChatGPT, signed in as you: list your conversations, read the private ones, and send what it found to them.

OpenAI fixed it on 26 October, eight days after the report, raised its rating from P2 to P1, the most serious level, and paid the researchers a US$5,000 bounty, according to Parameter's write-up. Nobody has reported it being used against real people. There's nothing for you to install. But it's a good moment to think about what's sitting in your chat history.

ChatGPT shared-link flawchatgpt.com, web
What
A public share link could run code as chatgpt.com in the visitor's signed-in session
What it could reach
In the researchers' tests: the list of your conversations, a private one never shared, and requests made as you
What it took
Opening the link. In the most automatic version, nothing else
Status
Fixed by OpenAI on 26 October 2026, on both versions of ChatGPT's website. No attacks reported
Found by
Mukul Goyal at Parameter, reported through OpenAI's bug bounty on 18 October
What's known.From Parameter's write-up. OpenAI hasn't published its own account.

Timeline

  1. HARD publishes its article, at Watch.

No single feature was broken. The researchers chained four small things together. ChatGPT can preview web pages it writes, in a fenced-off box. Its interactive graphs load a maths library, and that library listened for messages from other parts of the page without checking who sent them. A message could slip raw web code in. That code could open a new frame that wasn't fenced off, which counted as ChatGPT itself. A trick using a YouTube address got it past the last of ChatGPT's defences.

Put a conversation built to do all that behind a public share link, and anyone who opened it while signed in ran the attacker's code as themselves. In Parameter's tests, it read a private conversation from a separate account and workspace and sent part of it out.

People tell ChatGPT things they haven't told their family.

Why it matters to you

A chat history is a diary nobody meant to keep. Questions about a diagnosis, a draft of a hard email, a contract pasted in to be explained, the numbers of a sale or a settlement. For a family with something worth taking, that history is as sensitive as the inbox, and it's protected by one sign-in.

A shared link is an easy thing to send. It arrives from a colleague, a stranger in a group chat or an account pretending to be a friend, with "look what ChatGPT said about this". This flaw is closed, but the next one will look the same from the outside.

How this reaches a family
  1. 1A link to a shared chat“Look what ChatGPT said about this.” It comes from a colleague, a group chat or someone pretending to be a friend.
  2. 2You open it, signed inIt looks like any shared conversation. Underneath, it runs its maker’s code as you.
  3. 3Your chats leaveIt lists your conversations, reads the private ones and sends them out: the diagnosis, the contract, the sale.
HARDEngineerafter step 3In discovery, your engineer goes through the family’s accounts, AI chat apps included: two-step sign-in, which devices are signed in, and how much each keeps, so a flaw like this has less to find. How it works

What to do

  1. Nothing to update.ChatGPT runs on OpenAI's servers, and the fix is already in.
  2. Clear out what you wouldn't want read.Delete old chats about health, money, legal matters and the family. Check what ChatGPT's memory has saved about you in its settings, and remove what it shouldn't keep.
  3. Use Temporary Chat for sensitive things.Those conversations aren't saved to your history, so there's nothing to read later.
  4. Turn on two-step sign-in.On every family member's ChatGPT account, so a stolen password alone isn't enough.
  5. Be wary of shared chats from strangers.Open a shared ChatGPT link only when you know who sent it and why, the same as any other link.

Or have someone tidy it up for you. Knowing which accounts hold the family's most private conversations, and making sure each one is locked down, is part of what private cybersecurity is for.

Sources

  1. Do the math: how we took over ChatGPT accountsThe researchers' write-up: the chain, what it could reach, the timeline from 13 to 26 October, OpenAI's P1 rating, the fix and the bounty.Parameter ·

References

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.