AI-generated illustration
Security firm Parameter found a flaw in ChatGPT’s shared-link feature. A malicious link could run attacker code in the session of anyone who opened it. Parameter reported the bug to OpenAI on October 18 through OpenAI’s bug bounty program. OpenAI fixed it on October 26, eight days later. The fix covered two versions of ChatGPT’s web frontend. Parameter published its write-up on October 28. The write-up walked readers through the full chain of bugs.
How the Attack Worked
The attacker needed only a shared link. In the original version, the victim had to open the link and click Preview once. In a later version, simply opening the link was enough. The injected code could list the victim’s recent conversations. It could also open a private chat that the victim never shared. Then it could send part of that chat to a server the researchers controlled. Parameter said the code could perform any action on behalf of the victim’s ChatGPT account.
The Root Cause
The problem started in a MathLive library that ChatGPT used. A message listener in that library accepted messages from any sender. It also allowed raw HTML. That gap let a Preview frame push HTML into the main ChatGPT site. The new frame then inherited the chatgpt.com identity. Attackers still needed a script to deliver the payload. A YouTube script, which ChatGPT’s content security policy allowed, supplied that code.
Why It Matters
Shared links feel harmless. Many people send them to colleagues, friends, and family without a second thought. This flaw turned that habit into a risk. A single click could expose private conversations. The attack could also act inside a victim’s account. Users often store sensitive work, personal details, and code in their chat history. An attacker who reached that history could learn a great deal about a person. Work chats often include internal plans, customer names, and draft contracts. A leak like that could harm a company as well as an individual. Security teams should treat AI chat history as sensitive data.
What Researchers Found and What They Did Not
The parameter ran its test with separate test accounts. The researchers reported no real-world exploitation. That point matters for readers who want to judge the risk. A flaw that works in a lab is serious. A flaw that attackers already used would be worse. OpenAI rated the issue P1, its most serious category. The researchers said OpenAI raised the rating from P2. The bounty totaled $5,000.
What Users Should Do
ChatGPT users need to take no action, according to the researchers. The fix is already in the web app. Still, people should treat unexpected shared links with care. Open links only from people they trust. Be wary of links that ask for extra clicks or permissions. Review your shared chats, and delete any that contain sensitive data.
What Developers Can Learn
Teams that embed third-party libraries should check how those libraries handle messages. Message listeners need origin checks. Frames that render HTML need strict limits. Content security policies should not allow scripts from sites that could host attacker code. Security reviews should cover every component that can send messages to a parent page. Teams should also test embedded tools with malicious inputs before release. A short checklist can catch many of these issues early. Many of these bugs look minor until someone chains them together.
What Comes Next
OpenAI has closed this issue, but the lesson stays relevant. AI products add new features quickly, and each feature adds an attack surface. Readers should watch for further technical detail from Parameter and any follow-up from OpenAI. Users should keep their browsers and apps current. Companies that give staff access to AI tools should review their shared-link policies too. Clear guidance on sharing chats can reduce risk. Short training sessions help staff spot suspicious links before they click.
Related on Technwz: Samsung TVs Reportedly Use AI to Track Viewers
Sources: The Hacker News
