Until recently, a click on a shared ChatGPT link could allow a stranger to read your private conversations. Security firm Parametro described the attack chain in a detailed article on October 28. OpenAI had already solved the problem. Researchers reported this through OpenAI’s bug bounty program on October 18, and as of October 26, both versions of the ChatGPT web app blocked the attack. Parametro says it hasn’t seen any signs of real victims and has only tested the chain across its own accounts.
How the attack worked
The attack began with a normal shared conversation. The attacker creates a chat that contains an HTML preview and a graphic, then shares it with the regular share button. To draw the graph, ChatGPT loads MathLive, a library that comes with an on-screen keyboard for mathematical formulas. That keyboard accepted messages from any other window and inserted the HTML they brought into the page without checking it. This resulted in an unsandboxed frame that the browser treated as part of chatgpt.com. The site’s security rules also allowed scripts from YouTube, which the researchers used to run their own JavaScript.
That code was executed within the victim’s login session. It could retrieve the list of all chats, open a private conversation that has never been shared, and send parts of it to an external server. Through ChatGPT’s internal APIs it may have also acted on behalf of the victim, which Parameter describes as taking over the account. In the most reliable version, the victim had to press the preview button once. In a later variant the preview opened automatically, so you just had to click on the link.
A $5,000 reward and a library fix
OpenAI reproduced the report and increased its severity from P2 to P1 on October 21. He paid $5,000 in total. Developer Simon Willison thinks that’s a bit small for such a serious bug. MathLive has also changed its default settings. As of version 0.111.2, released on October 31, the keyboard only accepts messages from its own origin unless a developer allows others, according to the project’s changelog. The changelog does not mention ChatGPT.
What can you do now
You don’t have to do anything to fix this flaw, because OpenAI has fixed it from its side. It’s still worth checking out what you’ve shared. Anyone with one of your links can read the conversation and pass it on, and OpenAI’s help page says links can’t be limited to certain people or set to expire. In ChatGPT, go to Settings, then Data Controls, and click Manage next to Shared Links to see all the links you’ve created. You can delete them one at a time or all at once. Deleting the original conversation also deletes its link.
Links from forums, email, or chat are safest to open in a private browser window where you are not logged in. This attack required a logon session to cause damage. Chat histories are a popular target, as cloaked ad blockers reading ChatGPT and Gemini chats have previously shown. The new PIN lock for individual chats only blocks people with access to your device from viewing and doesn’t encrypt anything.
I write about cybersecurity and artificial intelligence. Cyber security is one of my regular topics, among others for Golem.de. At Notebookcheck, my focus is on practical AI for everyday users. I’ve been working directly with AI for years, most recently focusing on AI agents and their use in everyday work, and I try tools and models myself instead of just reading about them.
