Security researchers at Parameter found that a malicious public ChatGPT share link could execute attacker-controlled JavaScript inside the logged-in session of whoever opened it. The code could enumerate recent conversations, retrieve content from a private chat that had never been shared with the attacker, and send that data to an attacker-controlled server. OpenAI reproduced the issue, rolled out a fix across two ChatGPT web frontends, and confirmed it resolved on October 26, 2026 as a P1-severity issue. The bug bounty was $5,000.
The exploit combined ChatGPT's HTML Preview sandbox with the MathLive library in the main page. MathLive accepted state-changing messages without verifying which frame sent them, allowed raw HTML to be supplied as keyboard-layout data, and that HTML could create an unsandboxed document with chatgpt.com identity. A content-security-policy workaround via a YouTube response completed the chain, giving the attacker the same authenticated access as the victim's ChatGPT account.
Security researchers at Parameter demonstrated that a crafted public ChatGPT share link could run code in a visitor's signed-in session and exfiltrate private chat data. OpenAI fixed the issue on October 26, 2026, rated it P1 severity, paid a $5,000 bounty, and no real-world exploitation has been reported. This is a promotional/subjective “which AI is best” post, not a specific factual claim. This is a podcast/teaser framing, not a checkable factual claim. This is a link to jokes, not a factual claim.
CA public ChatGPT share link could read your private chats.
MThat's a serious claim. What actually happened?
CFady Eid posted the details on X. Security researchers at a firm called Parameter found it.
CA crafted share link could run code inside the logged-in session of whoever opened it.
MRun code where? In the browser, with my ChatGPT account?
CExactly. It could pull recent conversations, including private chats you never shared with anyone.
MSo someone sends me a link, I click it, and they're inside my history. That's not a bug, that's a break-in.
COpenAI reproduced it, by the way. This wasn't a paper claim.
MOf course they reproduced it. That's when you know it's real.
CThey fixed it October twenty-sixth, rated it priority one, and paid a five thousand dollar bounty.
MFive thousand dollars for reading private chats? That feels insultingly low.
CIt's not about the payout. It's about the fix, and the fix happened before anyone was known to be hit.
MBut the bug existed. A public share link should never have had that much power.
CNo, wait— every rich content platform has to sandbox links. This one had a hole. They closed it.
MThe chain is wild. They used the math rendering library to smuggle raw HTML.
CThe MathLive library accepted state-changing messages without verifying which frame sent them.
MA math tool became the door.
CBasically. That HTML then created an unsandboxed document with ChatGPT's identity.
MAnd a YouTube response helped them slip past the content security policy.
CRight. That gave the attacker the same authenticated access as the victim.
COne of the researchers, Mukul Goyal, put it plainly— quote— "essentially, we could perform any action on behalf of the victim's ChatGPT account."
MWhich means read, send, maybe delete. No known real-world exploitation, but the capability was sitting there.
CAnd OpenAI fixed it same week. The Hacker News called it a malicious share link that could read private chats.
MHere's my problem. People use ChatGPT for work, for drafts, sometimes for sensitive stuff.
MRegular people paste résumés, medical questions, private drafts into these chats. They're not thinking about sandbox escapes.
CThat's why the fix matters. The bug was in the share feature, not in the model reading your data.
MIt doesn't matter which layer. The result is the same: a stranger can reach your private chat.
MA link shouldn't be able to reach all of that, no matter how fast they patch it.
CBut that's the web! You can't make sharing without some attack surface.
MYou can make it so a shared link doesn't inherit my full signed-in session.
CThey did make it safer after this. That's the entire point of the fix.
MThey paid five thousand dollars. That's not "we take this seriously" money for a priority one.
CSeverity drives the bounty, and priority one isn't the highest payout unless there's active exploitation.
MNo one got hurt, but that relies on the researchers being the only ones who found it. That's not guaranteed.
CThe question is whether they respond well, and they did.
MI'll give them that. But this is another reminder: your chat history is only as private as the browser tab.
CFair. Don't click random ChatGPT share links. Actually, don't click random anything.
MNow he tells me.
CIf you did click before October twenty-sixth, there's no sign anyone was affected.
MSmall comfort. But fine— they fixed it fast. I'll take that over a slow trickle of patches.
CAnd the next time I share a ChatGPT link, I'll know exactly what's in the chain.