A Shared ChatGPT Link Could Run an Attacker's Code and Read Private Chats, Researchers Say; OpenAI Rated It P1 and Fixed It in Eight Days
Security firm Parameter says a crafted ChatGPT share link could run attacker code inside a victim's signed-in session and read private conversations, after one click on ChatGPT's Preview button or, in a later version, just opening the link. It reported the flaw on October 18; OpenAI reproduced it, raised it from P2 to P1 and had a fix in place by October 26, paying $5,000. Parameter reports no real-world use and ran its proof between its own accounts.
The model was never the weak point here. Parameter's chain ran through the parts of ChatGPT that turn a conversation into a small web app, a code preview and an interactive graph, and found that two safe-looking features could be made to talk across the sandbox between them. As chat products render more live content, the attack surface looks more like a browser's than a model's.
What Parameter found#
A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, letting the attacker read private conversations, researchers at Parameter showed, according to The Hacker News. In the most reliable version the victim opened the link and clicked ChatGPT's Preview button once; in a later version, opening the link was the only step, the report says.
Once running, the code called ChatGPT's own signed-in APIs, listed the victim's recent conversations and sent part of a private chat to a server the researchers controlled, The Hacker News reported. "Essentially, we could perform any action on behalf of the victim's ChatGPT account," the researchers wrote.
At a high level, the Preview sandbox itself held, Parameter says. The break came because a math-input library loaded into the main ChatGPT page accepted messages from any frame, and those messages could carry raw HTML that the main page then trusted.
What OpenAI did#
Parameter reported the flaw through OpenAI's bug bounty program on October 18. OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1, and by October 26 both versions of ChatGPT's web frontend rejected the messages the attack relied on, Parameter says. OpenAI paid $5,000 for the report, and Parameter published its writeup on October 28, after the fix.
ChatGPT users do not need to do anything, because the fix is on OpenAI's side, The Hacker News reported.
Preview belongs to a growing family of ChatGPT features that build and run web content, alongside the hosted apps OpenAI introduced with ChatGPT Sites.
Limits#
- The account of the flaw, OpenAI's response and the bounty comes from Parameter, the researchers who found it; The Hacker News relays Parameter's writeup and is not an independent test. We did not find an OpenAI statement.
- Parameter does not report any real-world use of the flaw and ran its private-chat proof between separate accounts, not against real users. We cannot rule out earlier exploitation either way.