Skip to main content
Privacy & Security

A shared ChatGPT link could open a stranger's private chats

OpenAI fixed a flaw on October 26 that let researchers reach a signed-in visitor's account through an ordinary shared conversation.

6 Nov 2026

The link looked like an ordinary shared ChatGPT conversation. In a test by Parameter Labs, opening it while signed in let code reach a private chat the visitor had never shared. OpenAI fixed the reported flaw on October 26, 2026.

A screenshot from the controlled test shows the shared ChatGPT page after it was modified.
Parameter’s controlled demonstration showed that a shared link could alter the real ChatGPT page. The researchers then demonstrated access to a separate private conversation in their test. · Parameter Labs.

Image source

The researchers' original report describes a chain of web-application flaws. This was not a demonstration of a model being persuaded to reveal secrets; the attack exploited how different parts of the website communicated.

The restricted preview found a willing listener

ChatGPT can display a small interactive page inside a preview. Browser restrictions, often called a sandbox, keep that page from directly reading the surrounding account page.

But a component used to display mathematics accepted messages from the preview. Its on-screen keyboard could be customized with HTML, the code used to structure web pages. The preview supplied that code, and the trusted component inserted it into the main page.

The inserted code created another embedded page without the original restrictions. A further step using an allowed YouTube endpoint got JavaScript—the code that makes web pages interactive—to run with ChatGPT's web identity.

A public conversation reached a private one

The researchers combined the necessary graph and preview in a shared conversation. In their automatic version, a signed-in visitor needed only to open the link. The code then retrieved an unrelated private conversation and sent a small part of its contents to a server the researchers controlled.

That controlled demonstration established private-chat access. It does not establish that criminals used the flaw.

The fix had to reach both versions of the website

Parameter's timeline says OpenAI confirmed the fix across both affected web frontends on October 26. The failure was in the connection between components: a restricted preview could persuade a more privileged part of the page to create a new route into the account.

Simon Willison's summary brought the report to our attention. This revision also draws directly on Parameter's account.