Shared ChatGPT Link Could Execute Attacker Code and Exfiltrate Private Chats
A newly disclosed vulnerability in ChatGPT showed how a seemingly harmless shared conversation link could be weaponized to run an attacker's code inside the browser session of anyone who opened it — and, in the process, expose their private chats. Researchers at the security firm Parameter uncovered the flaw and reported it through OpenAI's bug bounty program on October 18. OpenAI patched the issue eight days later and classified it as P1, the company's most severe severity rating.
How the attack worked
The core problem was trust. ChatGPT's "share" feature lets users publish a conversation as a read-only link that anyone can open. According to the researchers, a crafted shared link could carry malicious content that executed within the context of the victim's logged-in ChatGPT session rather than in an isolated sandbox. Because the code ran in that authenticated context, it could reach beyond the shared conversation itself — including access to the victim's own private conversations.
That combination is what made the bug serious. An attacker did not need to compromise OpenAI's infrastructure or steal credentials directly. They only needed a victim to click a link that looked like an ordinary ChatGPT share URL. Once opened, the injected code could operate with the victim's session privileges, turning a convenience feature into a potential entry point for data theft.
The exact technical mechanism behind the execution was not detailed in the public summary, and RedSide Security is not speculating on the specific payload or browser behavior involved. What is clear is the impact class: cross-session code execution leading to unauthorized access to private chat data.
OpenAI's response
The timeline reflects a relatively fast remediation. Parameter submitted the report on October 18, and OpenAI shipped a fix by October 26. The P1 rating underscores how OpenAI viewed the risk — P1 is reserved for the most serious issues in its bug bounty taxonomy. The company has not, as of the public report, released a detailed technical advisory describing the root cause.
For defenders, the episode is a reminder that AI chat platforms now hold some of the most sensitive data in an organization: internal discussions, code snippets, customer details, and strategic planning. A flaw that lets an attacker read those conversations is not a minor privacy nuisance; it is a potential data breach vector.
Why shared links are a recurring weak spot
Shared-link features are attractive to attackers because they exploit normal user behavior. People click links from colleagues, communities, and search results without inspecting them closely. When the destination is a trusted domain like ChatGPT, the perceived risk drops further. Any feature that renders user-supplied content inside an authenticated application deserves scrutiny — the same lesson learned repeatedly with document viewers, note-taking apps, and collaboration tools.
The bug also highlights the value of AI vendors running mature bug bounty programs. Parameter's report was handled and fixed within days, which is a far better outcome than public disclosure of an unpatched flaw. Organizations that rely on AI assistants should track vendor security advisories and ensure their own usage policies account for the possibility that shared AI content can be malicious.
Practical takeaways
- Treat shared AI links like any other untrusted link. Verify the sender and avoid opening share URLs from unknown or unexpected sources.
- Limit what you put into AI chats. Assume conversations could be exposed by a future vulnerability, and avoid pasting credentials, regulated data, or confidential material unless your organization's policy explicitly permits it.
- Watch vendor advisories. OpenAI and other AI providers publish security updates; security teams should route them into their normal patch and awareness processes.
- Report suspected issues. Bug bounty programs remain the fastest path to a fix. If you find something, report it responsibly.
The vulnerability is fixed, but its lesson is durable: in an era where AI assistants sit inside authenticated sessions holding sensitive context, a single shared link can be more dangerous than it looks.
