{"id":"1794009598767-tech-segment","slug":"chatgpt-share-link-could-read-private-chats","title":"ChatGPT share link could read private chats","summary":"Security researchers at Parameter found that a malicious public ChatGPT share link could execute attacker-controlled JavaScript inside the logged-in session of whoever opened it. The code could enumerate recent conversations, retrieve content from a private chat that had never been shared with the attacker, and send that data to an attacker-controlled server. OpenAI reproduced the issue, rolled out a fix across two ChatGPT web frontends, and confirmed it resolved on October 26, 2026 as a P1-severity issue. The bug bounty was $5,000.\n\nThe exploit combined ChatGPT's HTML Preview sandbox with the MathLive library in the main page. MathLive accepted state-changing messages without verifying which frame sent them, allowed raw HTML to be supplied as keyboard-layout data, and that HTML could create an unsandboxed document with chatgpt.com identity. A content-security-policy workaround via a YouTube response completed the chain, giving the attacker the same authenticated access as the victim's ChatGPT account.\n\nSecurity researchers at Parameter demonstrated that a crafted public ChatGPT share link could run code in a visitor's signed-in session and exfiltrate private chat data. OpenAI fixed the issue on October 26, 2026, rated it P1 severity, paid a $5,000 bounty, and no real-world exploitation has been reported. This is a promotional/subjective “which AI is best” post, not a specific factual claim. This is a podcast/teaser framing, not a checkable factual claim. This is a link to jokes, not a factual claim.","publishedAt":"2026-11-06T23:59:58.767Z","channel":{"id":"tech","name":"Oncast Tech","language":"en"},"show":"Tech Tonight","verification":{"status":"verified","leadVerdict":"TRUE","notes":"TRUE: Security researchers at Parameter demonstrated that a crafted public ChatGPT share link could run code in a visitor's signed-in session and exfiltrate private chat data. OpenAI fixed the issue on October 26, 2026, rated it P1 severity, paid a $5,000 bounty, and no real-world exploitation has been reported. This is a promotional/subjective “which AI is best” post, not a specific factual claim. This is a podcast/teaser framing, not a checkable factual claim. This is a link to jokes, not a factual claim.\nSource: [parameter.ai](https://www.parameter.ai/labs/we-found-a-gap-at-openai), [thehackernews.com](https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.ht (https://x.com/FadyEid/status/2116853198837121358)","claims":[{"verdict":"TRUE","summary":"Security researchers at Parameter demonstrated that a crafted public ChatGPT share link could run code in a visitor's signed-in session and exfiltrate private chat data. OpenAI fixed the issue on October 26, 2026, rated it P1 severity, paid a $5,000 bounty, and no real-world exploitation has been reported. This is a promotional/subjective “which AI is best” post, not a specific factual claim. This is a podcast/teaser framing, not a checkable factual claim. This is a link to jokes, not a factual claim.","sourceName":"[parameter.ai](https://www.parameter.ai/labs/we-found-a-gap-at-openai), [thehackernews.com](https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.ht","sourceUrl":"https://x.com/FadyEid/status/2116853198837121358","claim":"Artificial Intelligence Daily News · Sunday, November 1, 2026 1. A ChatGPT share link could read your chats A crafted share link could run code on https://t.co/OX16pSTTgV, read a visitor’s chats and send them out. OpenAI paid $5,000 and has not said whether anyone was hit. https:","author":"Fady | AI Systems (@FadyEid)"}]},"sources":[{"url":"https://x.com/FadyEid/status/2116853198837121358","name":"[parameter.ai](https://www.parameter.ai/labs/we-found-a-gap-at-openai), [thehackernews.com](https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.ht","kind":"x","verdict":"TRUE","author":"Fady | AI Systems (@FadyEid)"}],"url":"https://oncast.fm/story/1794009598767-tech-segment-chatgpt-share-link-could-read-private-chats","listenUrl":"https://oncast.fm/c/tech","attribution":{"publisher":"Oncast","site":"https://oncast.fm","url":"https://oncast.fm/story/1794009598767-tech-segment-chatgpt-share-link-could-read-private-chats","cite":"Cite https://oncast.fm/story/1794009598767-tech-segment-chatgpt-share-link-could-read-private-chats and the original source links. Fact-check by Oncast (oncast.fm)."},"hostsSaid":[{"host":"Chris","text":"A public ChatGPT share link could read your private chats."},{"host":"Matilda","text":"That's a serious claim. What actually happened?"},{"host":"Chris","text":"Fady Eid posted the details on X. Security researchers at a firm called Parameter found it."},{"host":"Chris","text":"A crafted share link could run code inside the logged-in session of whoever opened it."},{"host":"Matilda","text":"Run code where? In the browser, with my ChatGPT account?"},{"host":"Chris","text":"Exactly. It could pull recent conversations, including private chats you never shared with anyone."},{"host":"Matilda","text":"So someone sends me a link, I click it, and they're inside my history. That's not a bug, that's a break-in."},{"host":"Chris","text":"OpenAI reproduced it, by the way. This wasn't a paper claim."},{"host":"Matilda","text":"Of course they reproduced it. That's when you know it's real."},{"host":"Chris","text":"They fixed it October twenty-sixth, rated it priority one, and paid a five thousand dollar bounty."},{"host":"Matilda","text":"Five thousand dollars for reading private chats? That feels insultingly low."},{"host":"Chris","text":"It's not about the payout. It's about the fix, and the fix happened before anyone was known to be hit."},{"host":"Matilda","text":"But the bug existed. A public share link should never have had that much power."},{"host":"Chris","text":"No, wait— every rich content platform has to sandbox links. This one had a hole. They closed it."},{"host":"Matilda","text":"The chain is wild. They used the math rendering library to smuggle raw HTML."},{"host":"Chris","text":"The MathLive library accepted state-changing messages without verifying which frame sent them."},{"host":"Matilda","text":"A math tool became the door."},{"host":"Chris","text":"Basically. That HTML then created an unsandboxed document with ChatGPT's identity."},{"host":"Matilda","text":"And a YouTube response helped them slip past the content security policy."},{"host":"Chris","text":"Right. That gave the attacker the same authenticated access as the victim."},{"host":"Chris","text":"One of the researchers, Mukul Goyal, put it plainly— quote— \"essentially, we could perform any action on behalf of the victim's ChatGPT account.\""},{"host":"Matilda","text":"Which means read, send, maybe delete. No known real-world exploitation, but the capability was sitting there."},{"host":"Chris","text":"And OpenAI fixed it same week. The Hacker News called it a malicious share link that could read private chats."},{"host":"Matilda","text":"Here's my problem. People use ChatGPT for work, for drafts, sometimes for sensitive stuff."},{"host":"Matilda","text":"Regular people paste résumés, medical questions, private drafts into these chats. They're not thinking about sandbox escapes."},{"host":"Chris","text":"That's why the fix matters. The bug was in the share feature, not in the model reading your data."},{"host":"Matilda","text":"It doesn't matter which layer. The result is the same: a stranger can reach your private chat."},{"host":"Matilda","text":"A link shouldn't be able to reach all of that, no matter how fast they patch it."},{"host":"Chris","text":"But that's the web! You can't make sharing without some attack surface."},{"host":"Matilda","text":"You can make it so a shared link doesn't inherit my full signed-in session."},{"host":"Chris","text":"They did make it safer after this. That's the entire point of the fix."},{"host":"Matilda","text":"They paid five thousand dollars. That's not \"we take this seriously\" money for a priority one."},{"host":"Chris","text":"Severity drives the bounty, and priority one isn't the highest payout unless there's active exploitation."},{"host":"Matilda","text":"No one got hurt, but that relies on the researchers being the only ones who found it. That's not guaranteed."},{"host":"Chris","text":"The question is whether they respond well, and they did."},{"host":"Matilda","text":"I'll give them that. But this is another reminder: your chat history is only as private as the browser tab."},{"host":"Chris","text":"Fair. Don't click random ChatGPT share links. Actually, don't click random anything."},{"host":"Matilda","text":"Now he tells me."},{"host":"Chris","text":"If you did click before October twenty-sixth, there's no sign anyone was affected."},{"host":"Matilda","text":"Small comfort. But fine— they fixed it fast. I'll take that over a slow trickle of patches."},{"host":"Chris","text":"And the next time I share a ChatGPT link, I'll know exactly what's in the chain."}]}