ChatGPT share link vulnerability allowed access to private chats

Researchers at Parameter identified a vulnerability where a malicious ChatGPT share link could run attacker code within a logged-in user's session. The flaw was reported to OpenAI on October 18 through its bug bounty program. OpenAI classified the issue as P1, its highest severity level, and fixed it eight days later. By October 26, the company deployed a patch across two versions of the web frontend and paid a $5,000 bounty.

The attack vector involved a shared conversation link delivered via email or social media. Victims did not need to install software or join a workspace. In the most reliable scenario, users clicked the Preview button once. This action exploited an interactive graph feature that loaded the MathLive library into the main page. MathLive installed a listener that accepted messages without verifying the sender, allowing raw HTML to bypass security boundaries.

The attacker's code accessed ChatGPT's signed-in APIs directly, enabling the listing of recent conversations and reading of private chats. OpenAI confirmed it reproduced both the code execution and the private-chat access. The fix addressed the message handling flaw in the Preview feature.