A serious vulnerability in ChatGPT’s shared chat link feature was recently discovered that could let attackers run arbitrary code within a victim’s active session and access private conversations. The issue was uncovered by security researchers at Parameter, who reported it to OpenAI on October 18, 2026. OpenAI implemented a fix by October 26, classifying the flaw as “P1,” their most severe category.
How the Attack Worked
The attack began with a shared ChatGPT conversation link—just like any other you might receive via email, social media, or messaging. Victims didn’t need to install software, join new workspaces, or sign in again. In one version of the exploit, clicking “Preview” within the shared conversation was enough. A less obvious version triggered the preview automatically when the page loaded.
Once the link opened, malicious code executed inside the victim’s signed-in session on ChatGPT. The exploit allowed attackers to list recent conversations, open private chats that had never been shared, and extract parts of those conversations to an external server. The attack leveraged ChatGPT’s own APIs—giving the malicious payload the same privileges as the user. Essentially, the vulnerability enabled an attacker to act on behalf of the victim’s account.
Technical Root Causes
The flaw stemmed from the way shared chat links interacted with two built-in ChatGPT features: Preview (which renders HTML blocks as mini web pages) and an interactive graph that loads the MathLive library. Normally, the HTML preview displays inside a sandboxed frame to isolate it from the main site. But the interactive graph’s MathLive component accepted messages that included raw HTML for keyboard data. That allowed untrusted HTML to escape the sandbox, create a script-loaded frame with the full chatgpt.com identity, and ultimately execute malicious code via scripts hosted on allowed domains like YouTube.
The Fix and What Users Should Know
OpenAI validated the exploit and reproduced the ability to both run code and steal private-chat content. The patch prevents the kind of cross-frame messaging that permitted the exploit. As of October 26, both versions of the ChatGPT web frontend reject the harmful inputs that were being abused. Users don’t need to take any action—the fix has been deployed server-side, with no updates or resets required by individuals.
The report did not identify real-world exploitation of this flaw. Researchers conducted their tests in controlled conditions between separate non-colluding accounts. Parameter was rewarded $5,000 for the security disclosure.
This incident underscores the risks inherent to features that render editable or interactive HTML, especially when combined with cross-frame messaging. Going forward, both platform designers and users should be mindful of how third-party libraries like MathLive handle input from untrusted sources—particularly when that input can carry raw HTML.
Why It Matters in the Bigger Picture
This vulnerability highlights the broader challenge facing AI and web platforms: balancing rich functionality (graphs, previews, interactivity) with airtight security controls. Features meant to enhance user experience—interactive previews, embedded tools, 3rd-party script allowances—often open backdoors when the underlying trust boundaries aren’t airtight.
Organizations shipping AI-powered tools should treat sandboxing, origin checks, and content security policies as first-class features. For users, it’s a reminder to treat shared links there like any other external content—vigilant to where content originates and what permissions it may leverage.
