Researchers at the security firm Parameter uncovered a critical flaw in OpenAI’s ChatGPT platform that could allow attackers to run code in the logged in session of anyone who opened a malicious share link. The researchers reported the vulnerability through OpenAI’s bug bounty program on October 18, and the issue was resolved by the company eight days later, with the flaw rated as its most serious category, P1.
The flaw worked by exploiting a feature in ChatGPT that turns a block of HTML in a chat into a small web page through a feature called Preview. This feature can hold any code, but it is supposed to be sandboxed to prevent it from reading the main ChatGPT page. However, the researchers discovered a way to bypass this sandbox.
The attack chain began when a victim opened a seemingly ordinary ChatGPT conversation shared via its public link. The victim did not have to install anything or join a workspace; they only needed to open the link and click the Preview button. In a later version of the attack, the page was configured to open the Preview automatically, making the process even simpler.
Once the link was opened, the attacker’s code ran inside the victim’s signed in session with the same access as the real ChatGPT site. This allowed the attacker to list the victim’s recent conversations, open a private chat that had never been shared with the attacker, and send a small portion of it to a server controlled by the researchers. The code called ChatGPT’s own signed in APIs directly, not just copying what happened to be on the screen.
The researchers described the vulnerability in detail: The Preview feature can hold any code, but it is supposed to be sandboxed. The way in came from a second feature in the same conversation: an interactive graph that loaded a math library called MathLive into the main ChatGPT page. This MathLive library left a listener running that accepted messages about its on screen keyboard. The researchers found that this listener accepted messages from any sender and allowed raw HTML to be carried in these messages. This allowed the Preview to reach across the sandbox boundary and hand attacker generated HTML to the trusted main page.
The HTML built a new frame that the browser treated as part of chatgpt.com, and a script loaded from YouTube supplied the code that ran inside it. ChatGPT’s content security policy limits where a page’s scripts may come from, blocking inline code but allowing scripts from YouTube, which is why the attack worked.
OpenAI reproduced the code execution and the private chat proof, raised the severity from P2 to P1, and rolled a fix across two versions of ChatGPT’s web frontend. Both versions now reject the messages the attack relied on. Parameter traced the problem to three design choices that lined up in a way that allowed this attack to succeed.
The fix is on OpenAI’s side, with no action required from ChatGPT users. OpenAI paid a total of $5,000 for the report, which Parameter published on October 28, after the fix was implemented.
Source: https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html