ChatGPT Shared Link Flaw Could Run Attacker Code, Expose Private Chats

Security researchers at Parameter found that a malicious ChatGPT share link could execute attacker code in a victim's logged-in session, allowing access to private conversations. OpenAI fixed the flaw within eight days of disclosure and rated it P1, its most serious severity level.

Disclosed 18 October 2026 · Record updated 31 October 2026

Impact

Attackers could run code in a victim's ChatGPT session via a shared link and read the victim's private chat history.

Our coverage

Vulnerabilities

Shared ChatGPT link could run attacker code and read private chats

Researchers at Parameter reported the flaw to OpenAI on 18 October 2026; the company rated it P1 and fixed it eight days later.

31 Oct 2026

Sources

thehackernews.comhttps://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html