- Researchers at Parameter showed that a public ChatGPT share link could run someone else's code in the account of whoever opened it.
- Their demo read a victim's private chat. OpenAI rated the bug P1, fixed it on 26 Oct 2026 and paid a $5,000 bounty.
In short: a team at Parameter (write-up by Mukul Goyal, 28 Oct 2026) found a chain of bugs in ChatGPT through which a link to a shared conversation could run an attacker’s code in the account of whoever opened it. No installs, no pasted code. The bug is now fixed.
How the attack worked
- The chain combined three features that are harmless on their own: public chat sharing, an interactive graph and HTML Preview.
- Preview ran in an isolated frame, but the graph’s maths library listened for messages from other windows and did not check the sender.
- A crafted message injected HTML that created a new frame without a sandbox, so it carried the chatgpt.com identity. The researchers got around the CSP rules through an allowed third-party address.
- In the demo the code fetched the list of recent conversations, read one of the victim’s private chats and sent a small piece of it to an outside server.
Timeline and bounty
- 18 Oct 2026: reported through OpenAI’s bug bounty programme.
- 21 Oct: OpenAI reproduced the bug and raised its rating from P2 to P1.
- 23 Oct: CSP changes blocked part of the chain.
- 26 Oct: both web front ends rejected the malicious messages, the case was closed and a $5,000 bounty paid.
What builders can learn
The authors draw four lessons. Check both the origin and the specific sender window before accepting a message that changes anything. Do not pass raw HTML between windows. Keep dynamically created documents sandboxed whenever an untrusted frame can influence their content. Treat CSP as an extra layer, not the only barrier. It is a good checklist for any app that previews user content, including one built with AI help.
How to read this
This is the account of the researchers who found and reported the bug: the dates and the P1 rating come from them, not from OpenAI. The write-up does not say anyone exploited the bug before the fix. I write more about the traps in AI-built apps in the AI code security hub.