ChatGPT bug allowed strangers to read private chats via shared links

The discovery of the flaw

Security firm Parameter identified a significant vulnerability in ChatGPT that could have exposed private user data. The researchers discovered that a single click on a shared conversation link could grant a stranger access to a user's private chats. This issue was reported through OpenAI's bug bounty program on October 18.

OpenAI responded quickly to the report and officially fixed the vulnerability by October 26. The fix was applied to both versions of the ChatGPT web app to prevent the attack from being executed. While the bug was serious, Parameter noted they saw no evidence of any real victims using the exploit.

The security firm tested the attack chain between its own accounts to verify the risk. They raised the severity of the bug from P2 to P1 on October 21 as the team reproduced the report. This escalation reflected the high potential for account takeover and data theft.

How the attack worked

The exploit began when an attacker created a shared chat containing a specific HTML preview and a chart. To display the chart, ChatGPT loaded a library called MathLive, which provides an on-screen keyboard for math formulas. This library had a flaw where it accepted messages from any other window without checking their source.

Because the library did not check the source, it inserted HTML into the page that the browser treated as part of the official chatgpt.com domain. This created a frame without a sandbox, which is a security layer that isolates code from the rest of the site. Because the platform's safety settings permitted scripts from YouTube, the researchers were able to run their own JavaScript.

Once the script ran, it operated within the user's active login. It was able to retrieve a list of every chat, open private conversations that were never meant to be public, and transmit parts of that data to an external server. It could also use ChatGPT's internal APIs to perform actions on behalf of the user, effectively hijacking the account.

Impact on user privacy

The attack was designed to be simple for a victim to trigger. In the most reliable version, the user only had to press a preview button once to activate the script. However, a later version of the attack was even more dangerous because the preview opened automatically upon clicking the link.

This meant that anyone with a link to a shared conversation could potentially compromise a signed-in user. The researchers highlighted that chat histories are a popular target for malicious actors. They pointed out that disguised ad blockers have previously been used to read chats on both ChatGPT and Gemini.

While the flaw is now patched, it remains important to understand how shared links function. OpenAI's help page notes that shared links cannot be limited to specific people or set to expire. This means anyone who possesses a link can view the content of that specific shared conversation indefinitely.

Fixes and developer responses

OpenAI paid a total of $5,000 to the researchers for their discovery. Some developers, including Simon Willison, suggested that this amount was relatively low given the severity of the bug. The company's primary goal was to secure the platform and prevent unauthorized access to user data.

In addition to the platform fix, the MathLive library underwent changes to prevent similar issues. Starting with version 0.111.2, the keyboard is now configured to only receive input from its own source unless a programmer explicitly enables external communication. This change was documented in the project's changelog, though it does not explicitly mention ChatGPT.

The fix ensures that the browser will no longer treat external HTML as part of the ChatGPT site. By closing this loophole, OpenAI has blocked the specific path that allowed the researchers to run scripts in signed-in sessions. The update protects users from the specific chain of events described in the Parameter report.

Managing your shared links

Users do not need to take any technical action to fix the vulnerability since OpenAI has already deployed the patch. However, it is still a good practice to review what information has been shared publicly. Anyone who has a link to one of your conversations can read that specific chat and pass it along to others.

To manage your shared content, you can navigate to the Settings menu in ChatGPT. From there, go to Data controls and click Manage next to Shared links to see a full list of every link you have created. You have the option to delete these links one at a time or remove them all at once.

Deleting an original conversation will also automatically delete its associated shared link. For added safety, users can open links from forums or emails in a private browser window where they are not signed in. This prevents the session from being used to access more private data, as the attack required a signed-in session to function.