A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

A bug in ChatGPT share links meant a booby-trapped conversation page could run code as you while you were logged in. Researchers said that opened the door to reading private chats until OpenAI fixed it.

Imagine lending someone a photo album, and when they open it, a hidden note inside tells your house keys to make a copy.

That is roughly the shape of this ChatGPT bug.

Researchers at Parameter showed that a malicious ChatGPT share link could run an attacker’s code inside the logged-in session of anyone who opened it. If that sounds abstract, the practical effect is not: code running in your session can act with your access. In this case, the researchers said it could read private conversations.

OpenAI reportedly received the bug bounty report on October 18, fixed it eight days later, and rated it P1, its most serious category. That rating tells you this was not a cosmetic issue.

Why a shared link became a private data problem

A share link is supposed to be a safe wrapper around content you chose to make public. The whole point is separation: this page is shared, the rest of your account is not.

That line broke.

When attacker-controlled code can execute in the context of a site where you are already logged in, the browser does not see a stranger. It sees actions happening on a page you opened from a trusted service. That can let the code interact with data your account can access.

A simple way to think about it is a visitor badge in an office. The guest should only reach the meeting room. If the badge suddenly opens staff-only doors, the problem is not the guest alone. The building’s access rules failed.

For regular users, the key point is that this did not depend on stealing your password first. Opening the wrong shared page while logged in could be enough to hand over access to information that was never meant to be shared.

Why this kind of bug is more serious than it sounds

People tend to hear “share link” and assume limited blast radius. One page, one conversation, maybe some weird formatting issue. But web apps are full of trust boundaries, and when one of them collapses, a “public page” bug can turn into an “account data” bug very quickly.

That is what makes session-based attacks nasty. Your browser already holds the keys for your active login. If malicious script gets to operate there, it may be able to ask the app for more than the one page you intended to open.

Not every browser bug or web flaw leads to full account compromise. Details matter. But the researchers’ claim here was specific: attacker code could run in the victim’s logged-in ChatGPT session and read private chats. That is a direct hit on confidentiality.

And private chats in AI tools are not trivial data. People paste drafts, contracts, technical notes, health questions, customer details, and all sorts of half-finished thinking into these systems. Even when no password is exposed, the content itself can be sensitive enough to cause harm.

The good part and the practical part

The good news is that OpenAI fixed the issue quickly after the report. Eight days from report to fix is a strong response, especially for a P1 issue.

That does not mean people should shrug this off.

It is a reminder that “AI security” is often just web security with higher-value content sitting behind it. Fancy interface, old lesson. If a page can run untrusted code where it should not, private data is at risk.

A few practical habits help reduce the damage from bugs like this:

• Be careful with shared links, even when they point to familiar services.
• If a shared page looks odd, refreshes strangely, or behaves unexpectedly, close it rather than poking at it.
• Log out of services you are not actively using on shared or less-trusted devices.
• Keep browsers up to date, since modern browser protections can limit some attack paths even when they do not stop the root bug.
• Treat AI chat histories like email archives or cloud docs: useful, but potentially sensitive.
• Review what you paste into chat tools. If it would be painful to expose, consider whether it belongs there at all.

For organizations, this is also a policy reminder. Shared links from collaboration and AI tools should be treated like any other external content in awareness training and browser isolation discussions.

The useful final read is simple: a shared page should never have been able to reach back into someone’s private account data. In this case, researchers said it could, and OpenAI fixed it fast. That is good. The larger lesson stays with us: convenience features like share links are still part of the attack surface, and they deserve the same skepticism as any other web input.