Threat
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
First reported thehackernews.com
Page published
Earliest dated coverage: 31 Oct 2026 · First observed: 31 Oct 2026 · Latest dated coverage: 31 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
The ChatGPT shared-link flaw allowed public shared content to compromise an authenticated session and expose private conversations without requiring software installation or an attacker-controlled login.
Parameter researchers demonstrated a ChatGPT shared-link vulnerability that could execute attacker code in a logged-in viewer's session and read private conversations. An initial version required clicking Preview, while a later version triggered Preview automatically when the link opened. OpenAI fixed the flaw eight days after its October 18 disclosure and rated it P1, its most serious category.