ChatGPT Share Link Attack: How One Shared Chat Could Read Private Conversations, and What to Do Now

A security firm called Parameter showed that a booby-trapped ChatGPT share link could run an attacker's code inside the signed-in session of whoever opened it, then read that person's private conversations. OpenAI fixed it by October 26, 2026, eight days after the report, but it matters to any business whose staff paste customer details, code or plans into ChatGPT and open links from people they do not know.

What happened: the ChatGPT share link vulnerability

ChatGPT lets you share a conversation through a public link. On October 28, 2026, Parameter published "Do the Math: How We Took Over ChatGPT Accounts," showing how one of those ordinary links could be turned into an attack.

Here is the chain in plain terms, as Parameter describes it:

1. The attacker shares a chat containing two things: an HTML block that ChatGPT's Preview feature can display, and an interactive graph.
2. Drawing the graph loads a math library called MathLive into the main ChatGPT page. MathLive leaves a listener running that accepts messages about its on-screen keyboard.
3. That listener accepted those messages from any sender, and they could carry raw HTML that was placed into the page without being cleaned.
4. Preview runs in a walled-off frame that cannot read the main page. That wall held, but the Preview frame could still send the keyboard message. The HTML it carried created a new, unsandboxed frame that the browser treated as part of chatgpt.com.
5. ChatGPT's content security policy blocked inline scripts but allowed scripts from YouTube, so the researchers used a YouTube address to deliver the code that ran in that frame.

The victim did not install anything, join anything or sign in anywhere. In the most reliable version, they opened the link and clicked Preview once. In a later version, Preview opened by itself, so opening the link was the only step.

What is confirmed and what is claimed

Everything below comes from Parameter's own report. We did not find a public advisory from OpenAI, so the timeline is the researchers' account. They say OpenAI reproduced the issue and paid a bounty.

Is ChatGPT safe to use after this?

For this particular flaw, yes, as far as anyone has said publicly. Parameter reports that by October 26 both versions of ChatGPT's web frontend rejected the attack messages. The fix was made on OpenAI's side, so there is nothing to install for it.

What is not known is whether anyone else found the same path before the fix. Parameter does not say, and we found no OpenAI statement that answers it.

Why a ChatGPT security flaw matters to a company

Consider what lives in the ChatGPT accounts at a typical company: draft contracts, customer emails pasted in for rewording, source code, pricing, HR questions. Code running in an employee's signed-in session can read all of it, and the researchers say it could act as that employee too.

The delivery is the other problem. A link to chatgpt.com looks safe, and it can arrive anywhere a link can: email, team chat, a support ticket, a social post. Phishing training usually focuses on fake domains. This was the real one.

There is also an account angle. When employees use personal accounts for work, company information sits in accounts the business cannot see, secure or close when someone leaves.

What to do this week

If your team builds web apps

The root cause is a common one. Mozilla's developer documentation for postMessage is blunt: if you do not expect messages from other sites, do not add message listeners at all, and if you do, always verify the sender's identity and then the syntax of the message.

Parameter's own recommendations line up with that:

• Check both event.origin and event.source before acting on any cross-window message that changes state.
• Never accept raw HTML through cross-window settings.
• Keep dynamically created frames sandboxed when untrusted content can influence them.
• Treat your content security policy as a backup layer, not the only one.
• Test features together, not just one at a time.

Also look at third-party libraries. MathLive's listener came along when the graph feature loaded it, and it is easy to ship code like that without knowing what it listens for.

ChatGPT share link questions people are asking

Can opening a ChatGPT link hack my account?

Before the October 2026 fix, Parameter showed it could, if you were signed in and either clicked Preview or hit the later automatic version. That path is now closed. Links to real sites are usually lower risk than fake login pages, but this case shows the risk is not zero.

Do I need to update ChatGPT?

Not for this issue. The fix was made on OpenAI's side. Keep your browser and apps updated anyway.

Was anyone's ChatGPT data stolen?

Not known. Parameter tested only between its own accounts and does not report attacks on real users.

What is the ChatGPT Preview button?

It shows HTML from a chat as a simple web page inside a locked-down frame. That frame held; the weakness came from a second feature, the graph and its math library.

Is it safe to share my own ChatGPT chats?

Share only conversations you would be comfortable posting publicly, since anyone with the link can view them. Remove links you no longer need.

Should a business block ChatGPT?

Blocking often pushes staff onto personal phones and accounts. A clearer path is approved accounts, a short data rule and caution with unexpected links.

The bigger lesson

Each defense here worked on its own. The Preview sandbox held. The content security policy blocked inline scripts. The hole sat in the joins: a library listener that trusted any sender, next to a feature that could reach it. Businesses now run on tools built from many such parts, from AI assistants to website plugins, and the gaps tend to live where nobody tested them together. A trusted domain is not the same as trusted content.

Want someone to check the joins in your own systems? See security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: Parameter, "Do the Math: How We Took Over ChatGPT Accounts"; MDN Web Docs, Window.postMessage().