ChatGPT shared link vulnerability could read private chats, now fixed

1. 06:55
   X@TechsenseDev· Discussion

   One click on a shared link was enough. Parameter Labs showed a public ChatGPT share could run attacker JavaScript in a…(opens the original post in a new tab)
2. 03:46
   WebAI Threat Watch (aithreat.io)· Media coverage

   Общая ссылка в ChatGPT открывала личные чаты, OpenAI закрыла баг(opens the original post in a new tab)
3. 03:02
   WebAI Threat Watch (aithreat.io)· Media coverage

   ChatGPT, un lien partagé ouvrait les conversations privées, OpenAI corrige la faille(opens the original post in a new tab)
4. 01:45
   X@openwikipedia· Discussion

   Zero-Click Execution: Later versions of this exploit automated the process. Simply opening the link was enough. It cata…(opens the original post in a new tab)
5. 01:27
   X@The_Cyber_News· Discussion

   ‼ ChatGPT Flaw Allowed Attackers to Hijack Accounts and Steal Private Conversations With One Link Details: https://cy…(opens the original post in a new tab)
6. 01:04
   X@djcroman· Discussion

   A shared ChatGPT link could run attacker code in your session and read your private chats. Parameter Labs reported it…(opens the original post in a new tab)
7. 01:03
   X@PandaAgents· Discussion

   🚨 ChatGPT had a hole. Your private chats could leak with one click. OpenAI confirmed it and rated it the most serious t…(opens the original post in a new tab)
8. 00:18
   X@TimCohn· Discussion

   https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html(opens the original post in a new tab)

1. 22:41
   X@theadvtech· Discussion

   📡 Signal: A crafted ChatGPT share link could execute attacker code in the signed-in session of anyone who opened it, re…(opens the original post in a new tab)
2. 20:18
   X@spinidg· Discussion

   OpenAI fixes a ChatGPT vulnerability that could expose private conversations through shared links. Researchers at Param…(opens the original post in a new tab)
3. 20:02
   X@eggbaby· Discussion

   What's buzzing ### ChatGPT HTML preview share-link takeover disclosed Parameter Labs detailed a fixed ChatGPT account…(opens the original post in a new tab)
4. 19:18
   Profesional Review

   ChatGPT previously had a vulnerability that allowed reading users' private conversations, which has now been fixed

   Security company Parameter released a report stating that between October 18 and 26 there was an attack that read users' private conversations through ChatGPT shared links, and OpenAI has fixed the vulnerability. The attack link only needed to contain an HTML preview and a chart: when ChatGPT loaded the chart using the MathLive library, its math formula keyboard accepted messages from any other window, inserting unconfirmed HTML, forming an unsandboxed frame that the browser treated as part of ChatGPT and that could even execute JavaScript. Attackers could thereby obtain the full chat list, start new conversations, and send content to an external server, and the report states they could also act in the victim's name. OpenAI fixed the issue directly after setting a $5000 bounty; users do not need to make changes themselves, and can check shared links in the data controls in settings.

5. 18:58
   WebAI Threat Watch (aithreat.io)· Media coverage

   Researchers Discover High-Severity ChatGPT Flaw That Exposed Private Conversations to Attackers(opens the original post in a new tab)
6. 17:00
   WebBoannews (Korea)· Media coverage

   미리보기 한 번에 비공개 대화까지...챗GPT 공유 링크 결함, 8일 만에 수정(opens the original post in a new tab)
7. 17:00
   WebAI Threat Watch (aithreat.io)· Media coverage

   Уязвимость ChatGPT позволяла читать ваши личные чаты через ссылку общего доступа(opens the original post in a new tab)
8. 15:45
   WebAI Threat Watch (aithreat.io)· Media coverage

   Faille ChatGPT : un lien partagé exécutait du code(opens the original post in a new tab)

1. 20:11
   WebAI Threat Watch (aithreat.io)· Media coverage

   ChatGPT : un lien piégé pouvait exposer des conversations privées, la faille est corrigée(opens the original post in a new tab)
2. 07:33
   WebAI Threat Watch (aithreat.io)· Media coverage

   ChatGPT: un enlace compartido podía robar tu cuenta(opens the original post in a new tab)
3. 01:01
   X@trustBynh· Discussion

   https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html(opens the original post in a new tab)
4. 00:24
   X@techtactician· Discussion

   One shared ChatGPT link was enough to read someone's private chats. Parameter's researchers built a public chat that ra…(opens the original post in a new tab)
5. 00:20
   X@florian0707· Discussion

   A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats - https://thehackernews.com/2026/1…(opens the original post in a new tab)
6. 00:06
   X@ABabino· Discussion

   A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats https://thehackernews.com/2026/10/…(opens the original post in a new tab)
7. 00:00
   X@rfeio· Discussion

   A shared ChatGPT link could reportedly be exploited to trigger unintended actions, highlighting how AI integrations can…(opens the original post in a new tab)

1. 22:29
   X@don_tech1· Discussion

   Click a ChatGPT share link and your account belongs to someone else. This is the highest-severity vulnerability P1 confirmed by OpenAI itself, with a bounty of only 5,000 USD. That really is stingy. The security firm Parameter just disclosed this hole (already fixed): 1. The attacker sends you an ordinary…(opens the original post in a new tab)
2. 22:03
   X@LanzhiAI· Discussion

   Casually clicking a ChatGPT link someone shared — now you really have to be careful. A security team exposed a vulnerability: using a sandbox bypass, hackers can stuff malicious scripts into an ordinary public share link. As long as you are logged in and click it, the malicious code can run in the session and take over your account on the spot. Everyone is constantly tossing links back and forth to copy prompts, and this…(opens the original post in a new tab)
3. 21:13
   X@foukation· Discussion

   A security researcher found a way to access private ChatGPT conversations through a malicious shared link. In one test…(opens the original post in a new tab)
4. 20:49
   CSA Labs ResearchSelected

   One click into someone else's ChatGPT: a cross-frame messaging vulnerability

   Researcher Parameter disclosed on October 28, 2026 that a publicly shared ChatGPT conversation link could execute attacker-supplied JavaScript in the session of whoever opened it while logged in, enumerate their recent conversations, read private chats that were never shared, and exfiltrate data to an external server. After reproducing it, OpenAI raised the severity from P2 to P1 and completed the fix on the frontend of two versions on October 26 (eight days after the report), with no user action required; Parameter said no real-world exploitation was found. Initially a single click on Preview was required, after which it was changed to open automatically, so that merely opening the link triggers it, and the payload executes after about 4.5 seconds. The researcher said the same script context could perform any action on the account on behalf of the victim, but this is an inference based on the permissions obtained, and the PoC deliberately limited the exfiltrated content.

5. 20:41
   X@superdoccimo· Discussion

   Simply opening a ChatGPT shared link runs arbitrary JavaScript on the victim's authenticated session and can read even private conversations — this chain demonstrated by Parameter Labs in October was fixed on OpenAI's side on October 26. Meanwhile, the chain…(opens the original post in a new tab)
6. 20:27
   X@secbrief· Discussion

   The ChatGPT sandbox held. A math keyboard library just walked around it lol. A shared chat link could read your private…(opens the original post in a new tab)
7. 20:18
   X@PCS_AnthonyM· Discussion

   @TheHackersNews A shared link that could run attacker code inside a logged-in ChatGPT session is a good reminder that A…(opens the original post in a new tab)
8. 20:15
   X@_pksharma· Discussion

   🔓 The sandbox held. That is the odd part of this ChatGPT writeup. Parameter Labs says a public ChatGPT share link coul…(opens the original post in a new tab)
9. 20:15
   X@SaifuddinAmri__· Discussion

   A shared ChatGPT link could take over your account. Fixed by OpenAI on 26 Oct. https://www.parameter.ai/labs/we-found-a…(opens the original post in a new tab)
10. 19:58
    X@wildcanvasbull· Discussion

    🚨 A shared ChatGPT link could run attacker code in your session and read your private chats. No install. No login. J…(opens the original post in a new tab)
11. 19:25
    X@privacyneedle· Discussion

    A critical ChatGPT vulnerability allowed malicious shared links to execute code and expose private user chats. OpenAI c…(opens the original post in a new tab)
12. 19:18
    X@boussetta15a· Discussion

    عندما تصبح نافذة المعاينة باباً خلفياً: كيف كادت ثغرة "ChatGPT" أن تفتح سجلك الشخصي للمخترقين؟ حين يتعلق الأمر بعمالقة…(opens the original post in a new tab)
13. 19:09
    X@dsoch8c· Discussion

    Security company Parameter Labs discovered a ChatGPT vulnerability: users may have all their private conversations stolen simply by opening a specially crafted share link. Victims do not need to install a plugin or paste in code; as long as they click a specific link while logged in, a web component vulnerability becomes a springboard, allowing attackers to take over account permissions in the background. According to the research team…(opens the original post in a new tab)
14. 19:05
    X@luckyland· Discussion

    A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats https://thehackernews.com/2026/10/…(opens the original post in a new tab)
15. 19:00
    X@ai_dev_official· Discussion

    A single ChatGPT share link could run an attacker's code inside your logged-in session. Researchers at Parameter showe…(opens the original post in a new tab)
16. 18:24
    X@exploitgrid· Discussion

    OpenAI has fixed a ChatGPT flaw where a malicious shared link could run attacker code in a user’s logged-in session and…(opens the original post in a new tab)
17. 17:59
    X@sunset_evm· Discussion

    Full breakdown 👇 https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html(opens the original post in a new tab)
18. 17:59
    X@sunset_evm· Discussion

    Opening a shared ChatGPT link was enough to let an attacker read your private chats Security firm Parameter found a Ch…(opens the original post in a new tab)
19. 17:42
    X@read__the__diff· Discussion

    https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html(opens the original post in a new tab)
20. 17:41
    X@read__the__diff· Discussion

    ‼ Opening a shared ChatGPT link while signed in could make **your private conversations readable to an attacker**. Pa…(opens the original post in a new tab)
21. 17:15
    X@hs230303· Discussion

    A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats (The Hacker News・English) https://thehac…(opens the original post in a new tab)
22. 16:55
    WebAI Threat Watch (aithreat.io)· Media coverage

    Общая ссылка ChatGPT могла перехватывать сеансы и читать частные чаты(opens the original post in a new tab)
23. 16:36
    X@TweetThreatNews· Discussion

    Parameter researchers demonstrated that a malicious ChatGPT share link could run code in a logged-in session and access…(opens the original post in a new tab)
24. 15:57
    X@VeraGen_ai· Discussion

    A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats https://thehackernews.com/2026/10…(opens the original post in a new tab)
25. 15:31
    X@POSTURE_CYBER· Discussion

    OpenAI fixed a ChatGPT shared-link flaw that could run attacker code in a logged-in session and steal private chats. L…(opens the original post in a new tab)
26. 15:23
    WebAI Threat Watch (aithreat.io)· Media coverage

    Уязвимость ChatGPT позволяла читать закрытые беседы по ссылке(opens the original post in a new tab)
27. 15:00
    X@itsMikeKipruto· Discussion

    OpenAI patched a ChatGPT vulnerability that allowed malicious shared links to execute JavaScript in users’ authenticate…(opens the original post in a new tab)
28. 14:24
    X@phantmradar· Discussion

    🚨 ChatGPT: one shared chat link could run attacker code in your signed-in session and read your private chats. Paramete…(opens the original post in a new tab)
29. 14:01
    X@iCleanAI· Discussion

    $5,000: what OpenAI paid Parameter for a ChatGPT bug where opening a shared chat link, plus one Preview click, could ru…(opens the original post in a new tab)
30. 13:56
    X@dropy50· Discussion

    https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html(opens the original post in a new tab)
31. 13:56
    X@molari999· Discussion

    A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats https://ift.tt/BvkbjlH(opens the original post in a new tab)
32. 13:56
    X@dropy50· Discussion

    ثغرة في ChatGPT: رابط مشاركة خبيث ينفذ كود المهاجم في جلسة المستخدم ويستولي على محادثاته • أصلحت OpenAI ثغرة في ChatGP…(opens the original post in a new tab)
33. 13:34
    X@TheHackersNews· Discussion

    🚨 OpenAI fixed a ChatGPT flaw that allowed malicious shared links to execute attacker code in users' logged-in sessions…(opens the original post in a new tab)
34. 13:33
    The Hacker NewsSelected

    A malicious ChatGPT shared link can run attacker code in a logged-in session and read private chats

    Researchers at the security company Parameter demonstrated that a malicious ChatGPT shared link can run attacker code in a victim's logged-in session and read private chats; the researchers reported it on October 18 through OpenAI's bug bounty program, and OpenAI fixed it eight days later and rated it the highest severity, P1. The victim only needs to open the link and click Preview once (in a later attack version, opening the link triggers it automatically), and the attack code runs with the same permissions as the ChatGPT site, can call logged-in APIs to list recent conversations, open private chats that were never shared, and send the contents to a server controlled by the researchers. The vulnerability stems from three overlapping design issues, among which a listener left on the main page by the MathLive math library does not verify the message origin and allows raw HTML to be carried, enabling code inside the Preview sandbox to create a frame that inherits the chatgpt.com identity, and then execute code via a CSP-allowed YouTube script.

35. 12:13
    X@ehsayaan· Discussion

    We hacked ChatGPT at @Parameter_ai. Opening a malicious shared ChatGPT link could leak your private chats and compromi…(opens the original post in a new tab)
36. 11:21
    X@eddiboi· Discussion

    Parameter AI just found a P1 gap in ChatGPT! A single shared link could take over the account of anyone who opened it:…(opens the original post in a new tab)
37. 10:57
    X@Lniosytest· Discussion

    🚨 Holy crap, an outrageous vulnerability! A single ChatGPT share link can strip your account bare. You open a ChatGPT conversation share someone sent you. Nothing to install, nothing to click. Private chats, files, settings — the other party can take it all. I only understood how it works after reading the technical write-up: 🔹 ChatGPT's "web preview"…(opens the original post in a new tab)
38. 08:50
    X@quantictale· Discussion

    @parameter_ai putain using ChatGPT to hack ChatGPT, the irony. a single link giving access to private chats, files, set…(opens the original post in a new tab)
39. 07:35
    X@itz_mg_· Discussion

    we got a 1 click ATO on chatgpt(.)com just via a normal shared chat link. tl;dr html preview in chat -> postmessage…(opens the original post in a new tab)
40. 06:32
    X@parameter_ai· Discussion

    We hacked ChatGPT (using ChatGPT). We demonstrated that a single shared link could take over the account of anyone who…(opens the original post in a new tab)

Current attention 53·Peak in the comparable period 75 (Oct 31 23:00)·Change over the comparable past 24 hours +2%