Parameter
CompanySecurity timeline
- Vulnerability reported by Cyber Security NewsCritical ChatGPT flaw let one malicious link access private chats; OpenAI has fixed it
- Vulnerability reported by The Hacker NewsMalicious ChatGPT Share Link Could Expose Private Chats, Now Fixed by OpenAI
Recent news
Critical ChatGPT flaw let one malicious link access private chats; OpenAI has fixed it
A critical ChatGPT vulnerability allowed attacker-controlled JavaScript to run in a victim's signed-in session via a malicious shared conversation. It could list and read private conversations and exfiltrate data to an external server, with a single link sufficing in the demonstration. OpenAI fixed it on 26 October 2026 after a report from Parameter, which received a $5,000 bounty.
Malicious ChatGPT Share Link Could Expose Private Chats, Now Fixed by OpenAI
Parameter researchers showed that a malicious ChatGPT share link could execute attacker-supplied code within the logged-in session of any user who opened it, exposing private chats. They reported it through OpenAI's bug bounty programme on October 18, and OpenAI fixed it eight days later, rating it P1, its most serious category.