OpenAI Fixes ChatGPT Share-Link Bug That Could Expose Private Chats

OpenAI has fixed a ChatGPT share-link vulnerability that researchers say could have let an attacker run code in the browser of anyone signed in to ChatGPT who opened a specially crafted shared conversation. In a controlled test, the code reached a private chat that the visitor had not chosen to share. The researchers reported the flaw to OpenAI on 18 October, and say the company completed its fix on 26 October 2026. They have not reported evidence that criminals exploited it against real users.

The finding matters because a shared ChatGPT conversation is usually understood as a view of one selected exchange. A visitor should not have to assume that opening someone else’s link could expose other conversations in their own account. Security firm Parameter, which disclosed the research, says its proof of concept crossed that boundary. OpenAI awarded the researchers a total of $5,000 through its bug bounty programme, according to Parameter.

The attack began with content embedded in a publicly shared conversation, not with the visitor deliberately sharing a private chat. ChatGPT’s Preview feature normally runs untrusted material in a separate, restricted web environment. Parameter found a chain of interactions that let material from that environment influence a component on the main ChatGPT page. The result, the researchers say, was script execution in the visitor’s signed-in browser session.

This was a web security flaw, rather than the familiar problem of an AI assistant following malicious instructions in a document. The researchers describe a message-handling weakness involving a page component, followed by a way to execute script despite other browser restrictions. In their demonstration, they used the resulting access to list recent conversations, fetch an unrelated private chat and send a small extract to a server they controlled. Their account says OpenAI reproduced both the code execution and the private-chat test.

An early reliable version of the test required a click on Preview. Parameter says it later reproduced automatic triggering when a signed-in user simply opened the crafted share link. That distinction is important. The reported risk was not limited to someone running code knowingly or granting a browser permission. It arose from visiting a link that appeared to lead to an ordinary shared conversation.

What is known about the fix and user impact

Parameter says OpenAI received its report on 18 October and completed a fix across two ChatGPT web frontends on 26 October. The Hacker News reported the case on 31 October. The public accounts do not establish that attackers used the flaw outside the researchers’ authorised testing, or how many people, if any, encountered malicious links. The $5,000 payment is a bug bounty for disclosure, not compensation to affected users.

The fix was made to the service, so there is no special patch that ChatGPT users need to install for this particular issue. Users should still be wary of links from unknown senders and avoid treating a shared conversation as proof that its contents are trustworthy. Organisations whose staff handle sensitive material in AI tools should also review what information is placed in chats and who can access it. Those precautions are broader than this now-fixed bug, not evidence that private conversations were widely stolen.

The episode is a reminder that a product’s sharing controls and its browser security are separate promises. TechBooky has previously examined the limits of ChatGPT’s locked chats, but that feature is distinct from the share-link flaw reported here. In this case, the boundary that failed was between a restricted preview and the authenticated page around it. The researchers’ disclosure and OpenAI’s subsequent fix show why testing those boundaries matters as AI services add richer, more interactive content.