Shared ChatGPT link could run attacker code and read private chats

A malicious ChatGPT share link could run an attacker's code inside the logged-in session of anyone who opened it, giving the attacker access to that person's private conversations, according to researchers at the security firm Parameter.

The researchers reported the flaw to OpenAI through its bug bounty programme on 18 October 2026. OpenAI fixed the issue eight days later and rated it P1, its most serious severity category, the researchers said. The flaw is resolved.

Share links are the feature that lets a ChatGPT user publish a conversation at a public web address so other people can read it. The researchers showed that a link crafted by an attacker did not simply display text. Instead, it could execute code in the browser session of the victim who clicked it. Because that session was already signed in to the victim's ChatGPT account, the attacker's code was able to reach private conversations held in that account.

That combination is what made the issue serious. A share link looks like ordinary content. Anyone who received one from a colleague, a forum post or a message would have no obvious reason to treat it as executable. The victim did not need to paste anything, install anything or approve a tool. Opening the link was enough, according to the Parameter research as reported by The Hacker News.

OpenAI's P1 rating is the top of its internal severity scale for bug bounty submissions. The eight-day turnaround covers the period between the report on 18 October and the fix. Neither the researchers nor OpenAI, in the account published, said whether the flaw had been used against real users before it was reported.

The case is a reminder that the risk in assistant products is not confined to what the model writes back. Features that surround the model, such as sharing, exporting and rendering, sit inside the same authenticated browser session as everything else a user has typed. A weakness in one of those features can reach the stored conversation history, which for many users includes work documents, code, credentials pasted in for debugging and personal information.

For security teams, the practical takeaway is that a ChatGPT share link is untrusted third-party content, in the same way an unfamiliar web page is. Links received from outside the organisation deserve the same caution as any other unsolicited URL, even when the domain looks familiar. Organisations that allow staff to share conversations externally may also wish to consider what sits in those accounts' histories.

No user action is required now that the fix is in place, based on the published account. The researchers did not report any ongoing exposure. The details of the underlying technique have been published by Parameter and summarised by The Hacker News.

The disclosure follows a pattern seen repeatedly in assistant and agent products: the model is not the only attack surface, and the plumbing around it carries session-level privileges that can be turned against the user. In this instance the reporting route worked as intended, with a bug bounty submission, a top-severity rating and a fix inside of eight days.