ChatGPT previously had a vulnerability that allowed reading users' private conversations, which has now been fixed

Security company Parameter released a report stating that between October 18 and 26 there was an attack that read users' private conversations through ChatGPT shared links, and OpenAI has fixed the vulnerability. The attack link only needed to contain an HTML preview and a chart: when ChatGPT loaded the chart using the MathLive library, its math formula keyboard accepted messages from any other window, inserting unconfirmed HTML, forming an unsandboxed frame that the browser treated as part of ChatGPT and that could even execute JavaScript. Attackers could thereby obtain the full chat list, start new conversations, and send content to an external server, and the report states they could also act in the victim's name. OpenAI fixed the issue directly after setting a $5000 bounty; users do not need to make changes themselves, and can check shared links in the data controls in settings.