Shared ChatGPT Link Could Have Let Attackers Read Private Chats

Researchers at security firm Parameter showed that a booby-trapped ChatGPT share link could run an attacker's code inside the logged-in session of anyone who opened it. In their test, the code listed the victim's recent conversations, opened a private chat that had never been shared, and sent a small portion of it to a server the researchers controlled. They wrote that they could "perform any action on behalf of the victim's ChatGPT account". The link looked like any ordinary shared chat and could be delivered by email, chat message, support ticket or social post.

The victim did not need to install anything or sign in through the attacker. In the most reliable version, they opened the link and clicked ChatGPT's Preview button once. In a later version, the page opened Preview automatically, so opening the link was the only step. Parameter reported the flaw to OpenAI's bug bounty program on October 18. OpenAI fixed it eight days later and rated it P1, its most serious category. Parameter does not report any real-world use, and its private-chat proof ran between separate accounts rather than against real users.

According to Parameter, ChatGPT's Preview feature runs HTML in a locked-down frame on a separate web address, and that sandbox held. The way in came from a second feature in the same chat: an interactive graph that loaded a math library called MathLive into the main ChatGPT page, leaving a listener running that accepted messages about its on-screen keyboard. This article covers only the opening of the research.