A public ChatGPT conversation could be turned into a link that exposed the private account of whoever opened it, security researchers at Parameter Labs say. They found a way for a malicious share to run JavaScript inside the signed-in user’s ChatGPT session, where it could access private conversations and take actions through the user’s account.
The attack relied on two features that were not meant to work together: an interactive graph and ChatGPT’s HTML Preview, which displays code as a small webpage. Parameter Labs says it used the pair to cross the browser barrier that was supposed to keep untrusted preview code separate from the main ChatGPT page.
How did the attack work?
The researchers traced the flaw to MathLive, a library ChatGPT used to support graphs. MathLive added a message listener to the main page to control an on-screen keyboard. A preview could send messages to that listener, which did not check that the messages came from a trusted place. The listener then put supplied HTML into the main page.
That did not make script tags run by itself. But Parameter Labs found a way to get the page to create a new, unsandboxed frame. Because that frame was created by the main ChatGPT page, it could run with the site’s identity and use the victim’s signed-in session. The researchers say they used this access to list conversations, retrieve a private conversation that had never been shared with them, and send its contents to an outside server.
Parameter Labs says the attack could be delivered in an ordinary public share, without asking the victim to install an app or join a workspace. In one reproduction, opening the share was enough; in an earlier version, the victim had to click ChatGPT’s Preview button once.
What did OpenAI do?
OpenAI fixed the issue on October 26, 2026, and classified the report as P1, according to Parameter Labs. Simon Willison, who wrote about the research, says OpenAI paid a $5,000 bug bounty. The published accounts describe the fix, but do not say whether the researchers or OpenAI found evidence that anyone used the flaw against real users.
The incident illustrates why a preview can be risky even when it runs in a restricted frame: its safety also depends on how the surrounding page handles messages and embedded content. Parameter Labs’ attack combined those pieces into a shareable link, rather than requiring a victim to run code themselves.
Why it matters
For people who use ChatGPT, the flaw meant that opening a malicious shared conversation could expose private chats without installing anything. OpenAI says the issue was fixed on October 26; the accounts do not establish whether attackers exploited it before then.
