Shared ChatGPT Link Flaw Could Have Exposed Private Chats, but OpenAI Has Now Fixed It
A recently patched ChatGPT security flaw could have allowed an attacker to read private conversations simply by convincing someone to open a shared ChatGPT link. The issue was reported to OpenAI through its bug bounty program on October 18 and was fully blocked in the ChatGPT web app by October 26.
Security researchers at Parameter disclosed the details on October 28, explaining that they only tested the exploit between accounts they controlled. According to the researchers, there is currently no evidence that real users were affected.
The flaw is still a reminder of how sensitive AI chat histories can be. Many people use ChatGPT for work, coding, personal planning, research, and private questions, which makes account security and shared link management increasingly important.
How the ChatGPT shared link attack worked
The attack started with a normal shared ChatGPT conversation. An attacker could create a chat containing an HTML preview and a chart, then share it using ChatGPT’s built-in sharing feature.
The problem involved MathLive, a math input library used to display the chart. MathLive includes an on-screen keyboard for writing formulas. In this case, that keyboard accepted messages from other windows and inserted HTML into the page without properly verifying where the message came from.
That behavior allowed the researchers to create a frame that was not sandboxed. The browser then treated it as part of the ChatGPT website. Because ChatGPT’s security policy also allowed certain external scripts, the researchers found a way to run JavaScript inside the victim’s logged-in ChatGPT session.
Once running in that session, the malicious code could access the victim’s chat list, open private conversations that had never been shared, and send parts of those chats to an external server. The researchers also said the same method could potentially perform actions through ChatGPT’s internal APIs, effectively allowing account takeover-style behavior.
In the first working version of the attack, the victim needed to click the preview button once. A later version made the preview open automatically, meaning that simply clicking the shared ChatGPT link could have been enough.
OpenAI fixed the flaw and paid a bounty
OpenAI confirmed the report and increased the severity rating from P2 to P1 on October 21. The company paid a total bug bounty of $5,000.
Some security observers felt the reward was modest considering the potential impact. A flaw capable of exposing private ChatGPT conversations could be extremely serious, especially for users who store business data, personal notes, technical information, or confidential drafts in their chat history.
MathLive also changed its default behavior after the report. Since version 0.111.2, released on October 31, its keyboard only accepts messages from the same origin unless developers specifically allow other sources. This helps reduce the risk of similar attacks in other web applications.
What ChatGPT users should do now
OpenAI has already fixed this specific issue, so users do not need to take emergency action to protect themselves from this particular flaw.
However, it is a good idea to review your shared ChatGPT links. Anyone with one of your shared links can view that conversation and forward it to others. Shared links are not limited to specific people, and they do not automatically expire.
To check your shared links in ChatGPT, open Settings, go to Data controls, and select Manage next to Shared links. From there, you can review every shared conversation link you have created. You can delete individual links or remove them all. Deleting the original conversation also removes its shared link.
For extra safety, consider opening links from forums, emails, social media, or messaging apps in a private browser window where you are not signed in to ChatGPT. This particular attack required the victim to be logged in, so avoiding active sessions when opening unfamiliar links can reduce risk.
AI chat histories are becoming valuable targets
As more people rely on AI assistants, chat histories are becoming a growing target for attackers. Conversations may include passwords, business plans, client details, source code, legal questions, medical concerns, or personal information.
Previous security concerns have also involved browser extensions disguised as helpful tools, including ad blockers that secretly accessed AI chat data. This shows why users should be careful not only with shared links, but also with extensions, third-party tools, and websites that interact with AI services.
ChatGPT’s newer PIN lock for individual chats can help stop someone with access to your device from casually opening protected conversations. However, it does not encrypt chats or prevent online attacks by itself.
The key takeaway is simple: OpenAI has patched the shared link flaw, and there is no sign that it was abused in the wild. Still, users should treat AI conversations as sensitive data, regularly review shared links, avoid opening suspicious links while signed in, and be cautious about what they store in any AI chatbot.
