Parameter discloses a ChatGPT share-link flaw that let one opened link read private chats; OpenAI fixed it Oct 26 and rated it P1
Security firm Parameter published an exploit chain in which an attacker publishes a malicious conversation through ChatGPT's normal sharing feature; when a signed-in victim opens the /share/ link, the payload runs as chatgpt.com in their session, lists conversations, reads a private chat that was never shared, and sends data out. Parameter reported it through OpenAI's bug bounty on October 18; OpenAI raised it from P2 to P1, fixed it on October 26 and paid a $5,000 bounty. Parameter reports no real-world use, and users do not need to do anything.
Key Takeaways
- Timeline: reported Oct 18; OpenAI reproduced it Oct 21 and raised it from P2 to P1; both web frontends fixed by Oct 26; published Oct 28 (Parameter writeup)
- Very low bar: no app install, project join or pasted code; in the auto-preview variant, opening the link was the only action, firing after about 4.5 seconds (per Parameter)
- Three root causes: MathLive did not check the message sender, the message could carry raw HTML as keyboard-layout data, and that HTML could create an unsandboxed iframe with the chatgpt.com identity; YouTube JSONP was only the final CSP bypass
- Bounty was $5,000; Simon Willison called it "a bit cheap" for a flaw this serious (blog)
- MathLive 0.111.2 (Oct 31) now defaults to same-origin validation and blocks cross-window custom HTML layouts (changelog)
Linked Models & Agents: