A Shared ChatGPT Link Could Have Handed Strangers Your Private Chats
Researchers showed one booby-trapped ChatGPT share link could read a signed-in user's private chats. OpenAI fixed it in eight days and paid a $5,000 bounty.
Opening one shared ChatGPT link was enough to hand a stranger your private chats. Security researchers at Parameter built that attack, reported it to OpenAI, and were paid $5,000 once it was fixed. Nothing needs doing now: the hole was closed on 26 October.
How the trick worked
ChatGPT lets you share any conversation through a public link. In a writeup published on 28 October, Parameter’s Mukul Goyal showed that an attacker could plant hidden code in a conversation, share it, and send the link by email, chat or a social post.
When a signed-in user opened it, the code ran as if it were ChatGPT itself. In Parameter’s tests it listed the victim’s recent conversations, read a private chat that had never been shared, and sent part of it to an outside server. “Essentially, we could perform any action on behalf of the victim’s ChatGPT account,” the researchers wrote.
In the most reliable version, the victim opened the link and clicked ChatGPT’s Preview button once. In a later version the preview opened by itself, so the link was the only click. In those tests the code was running about 4.5 seconds after the link opened.
No single feature was broken. ChatGPT runs previews of web code in a walled-off box. But an interactive graph in the same chat loaded a maths keyboard tool called MathLive, and that tool accepted instructions from any sender, including the walled-off preview. A script allowed from YouTube did the rest.
Eight days to a fix
Parameter reported the bug on 18 October. OpenAI reproduced it on 21 October and raised it from P2 to P1, which The Hacker News describes as its most serious category. Both versions of ChatGPT’s web app were fixed by 26 October.
The $5,000 bounty drew comment. Developer Simon Willison wrote that it was “a bit cheap for a vulnerability this serious”. Parameter’s writeup describes only its own controlled tests.
It is the second ChatGPT privacy question in a week. On Thursday we reported that texting ChatGPT’s Dot agent isn’t end-to-end encrypted.
Why it matters
People paste health worries, contracts and work documents into chatbots, so a chat history is now worth stealing. The fix sits on OpenAI’s servers, but treating a shared chat from a stranger like any unknown link is still sensible.
