Researchers Show How a Shared ChatGPT Link Could Have Read Your Private Chats
Security firm Parameter found a chain of bugs that let a malicious public ChatGPT share run code in a visitor's session. OpenAI fixed it on October 26.
Security researchers at Parameter have described a flaw in ChatGPT’s web app that, until October 26, could have let a booby-trapped public share link run an attacker’s code inside a visitor’s logged-in session. The only action needed from the victim was opening the link. OpenAI has fixed it, rated it P1 (its high-severity tier, raised from an initial P2) and paid a $5,000 bounty.
How it worked, in plain terms. A shared conversation contained a graph that loaded MathLive, a maths-input library. MathLive listens for messages from other parts of the page, and an HTML preview component, which was sandboxed on a separate domain, could send it messages. MathLive did not check who was sending them and did not clean the HTML it received, so attacker-supplied markup ended up in the main ChatGPT page. That markup created an unsandboxed frame that inherited ChatGPT’s identity. A content security policy (a browser rulebook limiting what scripts may run) blocked inline scripts, but allowed YouTube, and a YouTube callback that echoed attacker input gave the code a way in.
The impact, per the researchers: the code could list the victim’s conversations, read a private chat that was never shared, and send part of it to an outside server. In their proof they sent only a small selected portion. They describe it as a practical cross-user data-theft route, which in effect means access to whatever the victim’s account can do in the web app.
What’s behind it: This is a classic web security lesson, not an AI-specific one. Three weaknesses lined up: messages between page components were trusted without checks, raw HTML was accepted, and frames were created without a sandbox. The researchers note that the content security policy was only a backup layer, and it proved to be the last wall standing. The timeline shows a normal, responsible process: report on October 18, reproduction and upgraded severity on October 21, partial fixes on October 22 and 23, both web frontends fixed on October 26.
What this means for you: You do not need to do anything about this specific bug, since it is fixed, and there is no public sign that it was used against real users. It is still a good prompt for habits: be a little careful with links to shared AI conversations from people you do not know, keep sensitive material out of chats you would not want leaked, and treat “share” features as public pages. For teams building on AI chat interfaces, the takeaway is to sandbox anything that renders third-party content.
Sources
Source: https://www.parameter.ai/labs/we-found-a-gap-at-openai
DeepMind Maps the World's Forest Types at 10-Metre Detail
ForTy, a new Google DeepMind and World Resources Institute map, sorts global land into primary, regrowth, planted and plantation forest, with honest accuracy limits.
