A malicious ChatGPT link could have let attackers secretly read private conversations and hijack a user's active session, security researchers have revealed. In controlled tests, the exploit retrieved a conversation that had never been shared with the attacker and sent part of its contents to an external server.
Researchers at cybersecurity firm Parameter demonstrated the vulnerability without stealing a password or requiring users to install software. The attack worked through ChatGPT's own conversation‑sharing feature.
OpenAI fixed the flaw on 26 October 2026, according to Parameter researcher Mukul Goyal, who published the findings two days later. The researchers used controlled test accounts, and there are no confirmed reports of criminals exploiting the vulnerability against ChatGPT customers.
How One Shared ChatGPT Link Could Expose Private Conversations
ChatGPT allows users to share individual conversations through public links. Parameter found that a specially crafted conversation could exploit this feature to execute malicious code when another user opened it while signed in.
‼️ ChatGPT Flaw Allowed Attackers to Hijack Accounts and Steal Private Conversations With One LinkDetails: https://t.co/NrUWECsNYmA critical ChatGPT flaw that let a malicious shared conversation run attacker-controlled JavaScript in another user’s signed-in session. The attack could list private chats, read conversations never shared with the attacker, and send stolen data to an outside server. Opening one crafted link was enough in the final demonstration.OpenAI fixed the issue on October 26, 2026, according to Parameter’s technical disclosure, published by Mukul Goyal on October 28. The company classified the report as P1 and awarded a $5,000 bounty. The demonstrated account access came through the victim’s active browser session, rather than a stolen password.#cybersecurityNews
— Cyber Security News (@The_Cyber_News) November 2, 2026
The researchers created a shared conversation containing an interactive graph and a prepared HTML Preview. In the most reliable version of the attack, the recipient had to open the shared link and click ChatGPT's Preview button.
A later version opened the preview automatically. This meant the recipient needed only to open the malicious link. Parameter reproduced that version three times using a separate test account. An alert confirming code execution appeared after approximately 4.5 seconds.
The researchers then demonstrated why the vulnerability was more serious than an unwanted pop‑up. Their code accessed ChatGPT's authenticated conversation APIs, listed recent conversations and retrieved an unrelated private chat.
It also transmitted a small portion of the response to a server controlled by the research team.
The attack established that someone could access private conversations through another user's active session. However, the researchers did not demonstrate permanent account takeover, password changes or locking users out of their accounts.
How the Attack Bypassed ChatGPT's Security Protections
The vulnerability involved an unexpected interaction between ChatGPT's HTML Preview feature and a mathematical library called MathLive.
HTML Preview allows ChatGPT to display interactive webpages generated from code. For security, these pages normally run inside restricted browser frames. This prevents code inside a preview from directly accessing the main ChatGPT page or its private information.
According to Parameter's technical disclosure, this protection initially worked. The weakness emerged when the shared conversation's interactive graph loaded MathLive into the main page.
MathLive included a component that accepted messages from other browser frames. The researchers discovered that it could process certain instructions without adequately checking their source. This allowed the restricted preview to insert attacker‑controlled HTML into the main ChatGPT page.
The researchers then used the inserted HTML to create a new browser frame without the original restrictions. A script response from a YouTube endpoint permitted by ChatGPT's security policy completed the chain, allowing code to run with the website's authenticated access.
Independent developer and security commentator Simon Willison examined the findings on 31 October. His analysis highlighted how the interaction between sandboxed previews, MathLive's messaging system and permitted third‑party scripts created the vulnerability.
OpenAI Fixed the Flaw Before Public Disclosure
Parameter submitted its findings to OpenAI's bug bounty programme on 18 October 2026. According to the research team, OpenAI reproduced both the code execution and private‑conversation access.
On 21 October, OpenAI reportedly raised the vulnerability's severity classification from P2 to P1. The company subsequently deployed fixes across two versions of ChatGPT's web interface.
By 26 October, both versions rejected the browser messages used by the exploit, Parameter said. The researchers reported that OpenAI marked the issue resolved and awarded a total bounty of US$5,000 (£3,708).
The fix was deployed through ChatGPT's website. Users did not need to download an application update to receive protection against this particular vulnerability.
The public findings describe how a malicious shared conversation could have exposed information that users had not intended to share. However, the evidence comes from controlled security testing, not a confirmed campaign against customers.
Parameter established that private conversations could be accessed and selected information transmitted externally, but the research does not establish that ordinary ChatGPT accounts were compromised in real‑world attacks.
The vulnerability has been fixed, but the incident shows how separate website features can interact in ways that undermine security protections designed to keep private information inaccessible.
