# ChatGPT Shared Link Vulnerability Allowed Unauthorized Access to Private User Conversations A critical security flaw enabled attackers to execute code within active user sessions. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-31 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/b1d80846-5a62-4c76-88bd-b7ae70467abb ## Critical Session Hijacking Flaw Security researchers at Parameter discovered a vulnerability in ChatGPT allowing attackers to execute arbitrary code within a victim's active session. By sending a malicious shared link, an attacker could gain full access to private conversations. This exploit bypassed standard security boundaries, effectively acting on behalf of the logged-in user without their knowledge. ## Exploitation via Preview Feature The attack relied on ChatGPT's Preview feature, which renders HTML blocks in a sandboxed frame. By manipulating this, researchers bypassed isolation protocols. Victims only needed to open the link, or in later iterations, simply click the Preview button. No additional software installation or workspace joining was required for the exploit to succeed. ## Mechanism of Cross-Frame Attack The flaw originated from the MathLive library, which left a listener active on the main page. This listener failed to verify the origin of incoming messages, allowing the sandboxed Preview frame to inject raw HTML into the trusted main site. This enabled the creation of unauthorized frames that appeared as legitimate chatgpt.com content. ## Bypassing Content Security Policies While ChatGPT employs content security policies to block inline scripts, the researchers utilized a script hosted on YouTube to execute their code. Because the platform allowed scripts from this specific domain, the malicious payload bypassed existing restrictions. This highlights the risks associated with trusting external domains within a complex web application architecture. ## Scope of Potential Impact Once the attacker's code executed, it gained the same permissions as the victim's session. It could list recent conversations, access private chats that were never shared, and exfiltrate data to an external server. The researchers confirmed that the code could perform any action available to the user, demonstrating a total account compromise. ## Response and Remediation Timeline Parameter reported the vulnerability through OpenAI's bug bounty program on October 18. OpenAI initially categorized it as P2 but upgraded it to P1, the highest severity level, after reproducing the findings. A fix was deployed across two versions of the web frontend by October 26, effectively neutralizing the attack vector for all users. ## No User Action Required OpenAI implemented the fix entirely on the server side, meaning users do not need to update their software, reset passwords, or install patches. The vulnerability was addressed by rejecting the specific messages that allowed the injection. Parameter confirmed that no real-world exploitation occurred, as their testing was conducted in a controlled environment. ## Security Implications for AI This incident underscores the necessity of rigorous cross-frame validation in AI interfaces that render dynamic content. As platforms integrate more interactive features like graphs and previews, the attack surface expands significantly. Developers must ensure that even trusted libraries do not inadvertently bridge the gap between sandboxed environments and the primary user session. ## Sources covering this story - https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._