Has OpenAI fixed the ChatGPT shared-link vulnerability?

Yes. According to the Parameter write-up, OpenAI fixed the issue on October 26, 2026, across two frontend versions. Content Security Policy changes on October 23 blocked part of the chain while the rollout was still in progress. OpenAI rated the report P1 and paid a $5,000 bounty.

What could an attacker do with the ChatGPT flaw?

Parameter says the injected code could list the victim's recent conversations, fetch a private conversation the attacker had never seen, and send the data to an outside server. The researchers say it could also call ChatGPT's authenticated APIs as the victim, which amounts to account takeover.

Did the victim need to do more than open the link?

No. Parameter reports the victim only had to open the shared link. An automatic Preview feature removed even the single Preview click that the first version of the chain needed. In their tests the payload ran about 4.5 seconds after the share was opened.

Parameter · 2026-10-31 · major

ChatGPT Shared-Link Flaw — one click ran attacker code in the victim's session

Parameter researchers chained flaws in ChatGPT's graph and Preview features so a public shared chat ran JavaScript as chatgpt.com. OpenAI fixed it on Oct 26, rated it P1 and paid a $5,000 bounty.

Parameter Labs write-up on a gap in OpenAI's ChatGPT

A public ChatGPT share could run attacker JavaScript inside the viewer's signed-in session until OpenAI patched it.

Key specs

Bounty	$5,000
Open ai severity	P1

Quick facts

Affected product	ChatGPT (public shared chats)
Reporter	Parameter researchers
Reported	Oct 18, 2026
Fixed	Oct 26, 2026
Severity	P1 (raised from P2)
CVE	None stated

What is it?

Parameter, a security research group, published a write-up of a chain of ChatGPT flaws that let a malicious public shared chat run JavaScript as chatgpt.com. The victim only had to open the link. OpenAI reproduced the report, raised it from P2 to P1 and fixed it on October 26, 2026.

How does it work?

An interactive graph loaded the MathLive library, which added a postMessage listener to the main page without checking the sender. A Preview could send HTML that was inserted with innerHTML, creating an iframe with no sandbox attribute. A Content Security Policy that allowed YouTube scripts was bypassed through YouTube's oEmbed JSONP callback, which returned attacker-controlled code.

Why does it matter?

Shared chats are links people open freely, so a flaw like this turns a normal share into a way to read private conversations. The fix is already live, so ChatGPT users need to do nothing. The report is a useful case study for anyone building features that embed third-party widgets next to sensitive sessions.

Who is it for?

security engineers, ChatGPT users, web app developers

Frequently asked questions

Has OpenAI fixed the ChatGPT shared-link vulnerability?: Yes. According to the Parameter write-up, OpenAI fixed the issue on October 26, 2026, across two frontend versions. Content Security Policy changes on October 23 blocked part of the chain while the rollout was still in progress. OpenAI rated the report P1 and paid a $5,000 bounty.
What could an attacker do with the ChatGPT flaw?: Parameter says the injected code could list the victim's recent conversations, fetch a private conversation the attacker had never seen, and send the data to an outside server. The researchers say it could also call ChatGPT's authenticated APIs as the victim, which amounts to account takeover.
Did the victim need to do more than open the link?: No. Parameter reports the victim only had to open the shared link. An automatic Preview feature removed even the single Preview click that the first version of the chain needed. In their tests the payload ran about 4.5 seconds after the share was opened.