Are ChatGPT shared links safe? What one fixed flaw could do

The trap looked like any other shared conversation. It could arrive by email, a chat message, a support ticket or a social media post. Nothing had to be installed. The target never joined a shared workspace or logged in through an attacker’s page.

The dependable version of the attack needed just two actions: open the link, then press the Preview button a single time. Parameter later tuned the page so the preview launched automatically, which cut the victim’s part down to one click on the link.

Once that happened, the attacker’s code ran with the same access as the real ChatGPT website. In the test, it listed the victim’s recent chats, opened one that had never been shared, and sent a small part of it to a server the researchers controlled. Because the code called ChatGPT’s own signed-in tools directly, the researchers said it could act on the victim’s behalf more broadly, not just read chats.

ChatGPT can turn a block of HTML, the code that makes up web pages, into a small working page through its Preview feature. Since that page can contain any code, ChatGPT runs it in a locked box on a separate web address, where it can’t touch the main ChatGPT page. That box held up.

The way out came from a second feature in the same chat: an interactive graph. Drawing it loaded a math tool called MathLive into the main ChatGPT page, and MathLive left a listener running that accepted messages about its on-screen keyboard.

• The listener accepted those messages from any sender, without checking where they came from.
• The messages were allowed to carry raw HTML as keyboard-layout data.
• That HTML could build a new, unsandboxed frame that the browser treated as part of ChatGPT’s own site.

The last step used a script loaded from YouTube, which ChatGPT’s security rules allowed while blocking other outside code. Parameter called that only the final workaround. The real problem was the three weak points lining up.

Parameter reported the bug through OpenAI’s bug bounty program on October 18. OpenAI reproduced both the code execution and the private-chat theft, raised the severity from P2 to P1, its most serious rating, and pushed a fix across two versions of the ChatGPT website. By October 26, both rejected the messages the attack needed.

Parameter published its writeup on October 28, after the fix was live, and OpenAI paid $5,000 for the report. The researchers say they saw no real-world use of the flaw, and their proof ran only between their own separate accounts. The fix is entirely on OpenAI’s side, so there is nothing to install or reset.

The fixed bug needed clever engineering. A simpler trick is already in the wild. In a campaign called LLMShare, found by Push Security, criminals bought Google ads aimed at people searching for ChatGPT. The ads led to a genuine ChatGPT share page that didn’t show a conversation at all. Instead, it displayed a fake outage notice telling visitors the website was down and they should download the desktop app.

The download button led to an impostor site that served malware for both Windows and Mac. Because the bait sat on a real OpenAI address, it slipped past the usual “check the domain” advice. Similar tricks have used shared Claude and Grok pages to trick people into pasting harmful commands.

This isn’t the first time share links have drawn researchers’ attention, either. An earlier Imperva study chained two cross-site scripting bugs, a type of flaw that lets an attacker run code inside a trusted site, with shared conversations to aim for account takeover. OpenAI fixed those too.

You don’t need to avoid share links, just treat them like any other link from someone you don’t know.

1. Only open share links from people you trust. An official ChatGPT web address proves the page is hosted by OpenAI, not that its content is honest.
2. Never download software from a share page. OpenAI doesn’t tell you to install its apps from inside a shared chat. Get the ChatGPT app from the official app stores or OpenAI’s own site.
3. Be wary of Preview buttons and pasted commands. If a shared chat asks you to run code or paste something into your computer’s terminal, close it.
4. Turn on multi-factor authentication. In Settings, under Security, you can add a second sign-in step or a passkey, so a stolen password alone isn’t enough.
5. Check your active sessions. The same Security menu lists signed-in devices. Log out any you don’t recognize.
6. Review links you’ve shared. Under Data controls you can see and delete your own shared links, which is worth doing if any include personal details.