A vulnerability in ChatGPT shared links allowed attacker code to run in a logged-in user’s session, granting access to private chats and enabling actions on behalf of the victim.

Once executed, the attacker could list recent conversations, access private chats, and send portions of chats to a server controlled by researchers, effectively acting with the victim’s ChatGPT permissions.

The attack exploited a shared chat link via ChatGPT’s Preview feature, where clicking the link could trigger code execution without installation, sign-in, or joining a workspace.

OpenAI fixed the issue across two frontend versions by October 26; safeguards blocked the exploit, and a YouTube step was not the root cause but a later workaround.

Parameter published its writeup on October 28, and OpenAI paid $5,000 for the report.

The vulnerability was reported through OpenAI’s bug bounty program on October 18 and fixed within eight days, rated Priority 1, the highest severity.

Researchers from Parameter reported the flaw to OpenAI on October 18; OpenAI fixed it within eight days and categorized it as P1, the most serious.

OpenAI’s mitigation requires no user action; the fix is on OpenAI’s side and does not require users to install updates.

No user-side action is needed—ChatGPT users did not need to install anything or reset settings as OpenAI rolled out the fix.

ChatGPT’s Preview renders HTML blocks as small sandboxed web pages, but researchers found a path to break out of the sandbox through a multi-step process.

Reliable tests showed the attack could be triggered by opening the link and clicking Preview; later versions allowed Preview to auto-open via the link.

In the most robust version, opening the link and clicking Preview once enabled the attack, while later versions made Preview open automatically, making the single step sufficient.