ChatGPT flaw let a shared link read your private chats

Until recently, one click on a shared ChatGPT link could have let a stranger read your private conversations. Security firm Parameter described the attack chain in a detailed write-up on October 28. OpenAI had already fixed the flaw by then. The researchers reported it through OpenAI's bug bounty program on October 18, and since October 26 both versions of the ChatGPT web app have blocked the attack. Parameter says it has seen no sign of real victims and only tested the chain between its own accounts.

How the attack worked

The attack began with an ordinary shared conversation. The attacker creates a chat that contains an HTML preview and a chart, then shares it with the normal share button. To draw the chart, ChatGPT loads MathLive, a library that comes with an on-screen keyboard for math formulas. That keyboard accepted messages from any other window and inserted the HTML they carried into the page without checking it. This produced a frame with no sandbox that the browser treated as part of chatgpt.com. The site's security rules also allowed scripts from YouTube, which the researchers used to run their own JavaScript.

That code ran inside the victim's signed-in session. It could fetch the list of all chats, open a private conversation that had never been shared, and send parts of it to an outside server. Through ChatGPT's internal APIs it could also have acted on the victim's behalf, which Parameter describes as taking over the account. In the most reliable version, the victim had to press the preview button once. In a later variant the preview opened automatically, so clicking the link was enough.

A $5,000 bounty and a library fix

OpenAI reproduced the report and raised its severity from P2 to P1 on October 21. It paid $5,000 in total. Developer Simon Willison thinks that is a bit low for a bug this serious. MathLive has changed its defaults too. Since version 0.111.2, released on October 31, the keyboard only accepts messages from its own origin unless a developer allows others, according to the project's changelog. The changelog does not mention ChatGPT.

What you can do now

You don't have to do anything about this flaw, because OpenAI fixed it on its side. It is still worth checking what you have shared. Anyone who has one of your links can read the conversation and pass it on, and OpenAI's help page says links can't be limited to certain people or set to expire. In ChatGPT, go to Settings, then Data controls, and click Manage next to Shared links to see every link you have created. You can delete them one at a time or all at once. Deleting the original conversation also deletes its link.

Links from forums, emails or chats are safer to open in a private browser window where you are not signed in. This attack needed a signed-in session to do any harm. Chat histories are a popular target, as disguised ad blockers that read ChatGPT and Gemini chats showed earlier. The new PIN lock for individual chats only keeps people with access to your device from looking and does not encrypt anything.