A security vulnerability in ChatGPT could have allowed attackers to execute malicious code within the browser sessions of logged-in users simply by sending them a specially crafted conversation-sharing link.
The flaw potentially exposed users’ private ChatGPT conversations, allowing attackers to access chat histories and retrieve sensitive information without requiring victims to download files, install software, or provide their login credentials.
The vulnerability was discovered by security researchers at Parameter and responsibly reported to OpenAI through its bug bounty program on October 18, 2026.
OpenAI addressed the issue eight days later and assigned it a P1 severity rating, placing it in the company’s highest severity category.
How the Malicious ChatGPT Share Link Attack Worked
The attack relied on an ordinary-looking ChatGPT conversation shared through a public link.
Attackers could distribute the malicious link through common communication channels, including:
- Email messages.
- Instant messaging platforms.
- Social media posts.
- Customer support tickets.
- Other online communication channels.
Victims did not need to install additional software, join an organization, or authenticate through an attacker’s website.
In the initial proof of concept, the victim only needed to open the shared conversation and click ChatGPT’s Preview button.
Researchers later developed another version that automatically opened the Preview feature, reducing the victim’s required interaction to simply opening the malicious link.
Once triggered, the attacker’s JavaScript code could execute within the victim’s authenticated ChatGPT browser session.
Attackers Could Access Private ChatGPT Conversations
The most concerning aspect of the vulnerability was its potential to expose conversations that users had never shared publicly.
According to the researchers, the malicious code could interact directly with ChatGPT’s authenticated APIs rather than relying on information displayed on the browser screen.
During their controlled demonstration, the researchers successfully:
- Retrieved the victim’s recent ChatGPT conversation history.
- Opened private conversations that had never been shared with the attacker.
- Extracted portions of private conversations.
- Transmitted the collected information to a researcher-controlled server.
Because the malicious code operated with the permissions of the authenticated ChatGPT session, its capabilities extended beyond simply viewing the shared conversation.
The researchers explained that the vulnerability could potentially allow actions to be performed on behalf of the victim’s ChatGPT account.
Importantly, the demonstration was conducted in a controlled environment using separate test accounts. The researchers did not report evidence of exploitation against real-world users.
How the Vulnerability Bypassed ChatGPT’s Security Sandbox
The vulnerability involved a chain of weaknesses connecting ChatGPT’s Preview functionality with an interactive graph feature.
ChatGPT allows users to transform HTML content inside conversations into interactive web pages using its Preview feature.
For security reasons, these pages run inside an isolated browser frame hosted on a separate origin. This sandbox is designed to prevent untrusted content from accessing the main ChatGPT website or its authenticated session.
However, researchers discovered that another feature within the same conversation provided a way to bypass this isolation.
Interactive Graph Feature Introduced the Weakness
The shared conversation contained an interactive graph that loaded a mathematical library called MathLive into the main ChatGPT webpage.
MathLive maintained a message listener that handled communications related to its on-screen keyboard.
Under normal security practices, browser messages exchanged between different frames should be validated to ensure they originate from trusted sources.
However, the researchers discovered that the listener accepted messages without properly verifying their origin.
More importantly, the messages could contain raw HTML as part of the keyboard-layout data.
This created an opportunity for malicious content running inside the isolated Preview environment to send attacker-controlled HTML to the trusted ChatGPT page.
Malicious HTML Escaped the Isolated Environment
After successfully exploiting the message-handling weakness, the researchers demonstrated that the injected HTML could create a new browser frame that inherited the security identity of chatgpt.com.
This allowed attacker-controlled JavaScript to execute in a context associated with the legitimate ChatGPT website.
The researchers also used a script hosted on YouTube to complete the code execution chain.
ChatGPT’s Content Security Policy (CSP) restricted the sources from which scripts could be loaded. Although inline scripts were blocked, scripts hosted on YouTube were permitted under the applicable policy.
This allowed the researchers to complete their controlled proof of concept.
The YouTube script was not the root cause of the vulnerability. The fundamental problem was the failure to properly validate messages crossing the security boundary between the Preview environment and the main ChatGPT application.
Three Security Design Issues Enabled the Attack
The researchers identified three main weaknesses that combined to make the attack possible:
- Insufficient message validation: The MathLive listener processed messages that could modify its settings without verifying which browser frame had sent them.
- Acceptance of untrusted HTML: The message handler allowed raw HTML to be supplied through keyboard-layout data, creating an opportunity for malicious content injection.
- Security boundary bypass: The injected HTML could create a browser frame that was not properly sandboxed and inherited the chatgpt.com security identity.
These weaknesses demonstrated how seemingly isolated application features can create serious security risks when their interactions are not properly validated.
OpenAI Fixed the ChatGPT Vulnerability
After receiving the report on October 18, 2026, OpenAI reproduced the researchers’ findings, including the code execution technique and the demonstration involving private conversations.
The company subsequently upgraded the vulnerability’s severity rating from P2 to P1.
A security fix was deployed across two versions of ChatGPT’s web frontend.
By October 26, both versions had been updated to reject the malicious messages used in the attack.
Parameter published its technical findings on October 28, after the vulnerability had been fixed.
OpenAI also awarded the researchers a total bug bounty payment of $5,000 for reporting the security issue.
Do ChatGPT Users Need to Take Any Action?
According to the researchers’ disclosure, the vulnerability was fixed on OpenAI’s side.
ChatGPT users do not need to install additional security software, change their account settings, or reset their passwords specifically because of this issue.
The incident nevertheless highlights the importance of secure browser isolation, proper message-origin validation, and strict handling of untrusted HTML in modern web applications.
As AI platforms continue adding interactive features, visualizations, and embedded web content, developers must ensure that these components cannot cross security boundaries or access authenticated user data without authorization.
The discovery also demonstrates that even a seemingly harmless shared conversation link can become a security risk when multiple application features interact in unexpected ways.
