// AI threat desk · 31 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighCHATGPTCVSS not assigned

ChatGPT share-link flaw could run code in logged-in sessions

A malicious ChatGPT share link could let attackers read private conversations and act through a victim’s account. Parameter reported the flaw to OpenAI on Oct 18 and published details on Oct 28.

· 2 min read
AI-generated image of hands beside a laptop displaying blurred chat and account windows in a dim office.
AI-generated image, not a photo of the event.
Key takeaways
  • Parameter said a malicious ChatGPT share link could run attacker code in a logged-in session and expose private conversations.
  • Parameter reported the flaw to OpenAI on Oct 18, and OpenAI fixed it eight days later.
  • On October 26, OpenAI confirmed that both frontend versions rejected the reported MathLive messages and resolved the issue.

OpenAI fixed a ChatGPT share-link vulnerability eight days after Parameter reported it through the company’s bug bounty program on Oct 18, the researchers said. OpenAI confirmed the fix on Oct 26, while the flaw could let code run in the logged-in session of anyone who opened a malicious shared conversation.

The code could also perform any action available through the victim’s authenticated ChatGPT account, Parameter said.

The vulnerability used ChatGPT’s ordinary public sharing feature, so the attack did not require the victim to install an app, join a project, paste code or open developer tools in one attack version. Parameter published its account on Oct 28.

On this page

The attack combined MathLive with ChatGPT Preview

Parameter said the attack placed an interactive graph that loaded MathLive and an HTML Preview that sent messages to it inside one ordinary public conversation.

Parameter reproduced the automatic-preview path three times in a separate account, including after a hard refresh, with an alert appearing after roughly 4.5 seconds.

The researchers said MathLive accepted a state-changing message without checking which frame sent it, while the message format allowed raw HTML as keyboard-layout data. The injected HTML could create an unsandboxed document that inherited the chatgpt.com identity.

The payload used ChatGPT’s authenticated access

ChatGPT’s content security policy blocked inline JavaScript but allowed scripts from YouTube, Parameter said. The payload used session information already available to the page to call ChatGPT’s conversation APIs.

The payload first enumerated recent conversations, then could request message data for a selected private conversation. It created an ordinary image request to a server controlled by the researchers.

OpenAI resolved the report through its bug bounty program

OpenAI confirmed that both frontend versions rejected the MathLive messages used in the report and awarded Parameter a total bounty of $5,000.

OpenAI confirmed on Oct 26 that both frontend versions rejected the cross-frame MathLive messages used in the report and marked the issue resolved. It awarded Parameter a total bounty of $5,000.

Parameter said message receivers should verify both the sender’s web address and the authorized window, and that dynamically created documents should remain sandboxed when an untrusted frame can influence their content.

What to do now

  1. Verify both the sender’s web address and the exact window that was given permission, Parameter recommends.
  2. Keep dynamically created documents sandboxed when their content can be influenced by an untrusted frame, Parameter recommends.

FAQ

What happened in the ChatGPT share-link vulnerability?

Parameter said a malicious shared conversation could run attacker code in the logged-in session of someone who opened it, allowing access to private conversations and actions through the account.

Who reported the ChatGPT vulnerability?

Parameter reported it through OpenAI’s bug bounty program on Oct 18, and parameter.ai published the researchers’ account on Oct 28.

How was the ChatGPT share-link attack reproduced?

Parameter said it reproduced the automatic-preview path three times in a separate account, including after a hard refresh, with an alert appearing after roughly 4.5 seconds.

How did the ChatGPT attack work?

Parameter said it combined an interactive graph that loaded MathLive with an HTML Preview that sent messages to it. The injected HTML could create an unsandboxed document inheriting the chatgpt.com identity.

Did OpenAI fix the ChatGPT share-link flaw?

Yes. OpenAI said on Oct 26 that both frontend versions rejected the reported cross-frame MathLive messages and marked the issue resolved.

Sources

  1. Do the Math: How We Took Over ChatGPT Accounts, ParameterPrimary
  2. A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats, The Hacker News
How we checked this story
ClaimSourceStatus
Parameter said a malicious ChatGPT share link could run attacker code in the logged-in session of anyone who opened it.Parameter, via The Hacker NewsAttributed
Parameter reported the vulnerability through OpenAI’s bug bounty program on October 18, and OpenAI fixed it eight days later.Parameter, via The Hacker NewsAttributed
Parameter said an attacker could deliver the payload through an ordinary public ChatGPT conversation shared by link.ParameterConfirmed
Parameter said opening the shared link was the only required action in one attack version.ParameterConfirmed
Parameter reproduced the automatic-preview path three times, including after a hard refresh, with an alert appearing after roughly 4.5 seconds.ParameterConfirmed
The exploit combined an interactive graph that loaded MathLive with an HTML Preview that sent messages to it.ParameterConfirmed
Parameter said MathLive accepted a state-changing message without checking its sender and allowed raw HTML in the message.ParameterConfirmed
The injected HTML created an unsandboxed document that inherited the chatgpt.com identity.ParameterConfirmed
ChatGPT’s content security policy blocked inline JavaScript but allowed scripts from YouTube.ParameterConfirmed
Parameter said the code could perform any action available through the victim’s authenticated ChatGPT account.ParameterConfirmed
On October 26, OpenAI confirmed that both frontend versions rejected the reported MathLive messages and resolved the issue.ParameterConfirmed
OpenAI awarded Parameter a total bounty of $5,000.ParameterConfirmed
parameter.ai published its report on Oct 28, 2026.parameter.aiConfirmed

Could not verify

  • Whether the vulnerability was exploited against real users is not established.
  • Whether a CVE was assigned is not established.
  • How many ChatGPT users were affected is not established.
  • Whether any private conversations were stolen outside the controlled test is not established.
openai
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok