A shared ChatGPT conversation is supposed to be a read-only postcard, not a way into someone else’s private threads. The Injection and later coverage of Parameter‘s research describe a bug in which “a public ChatGPT share link could run attacker JavaScript as chatgpt.com in any signed-in visitor’s session and read their private conversations.” OpenAI “fixed both web frontends on October 26, nine days after Parameter reported it,” and classified the issue as P1, according to contemporaneous reporting.
Quick Take
- What: A malicious public share link could escape its preview sandbox, run JavaScript as the ChatGPT origin, and read a signed-in visitor’s private chats.
- Reported: Parameter disclosed the issue to OpenAI in mid-October 2026.
- Fixed: October 26, 2026, on both web front ends.
- Status: Patched. There is no user update to install. Be cautious with old, untrusted share links from before the fix, as you would with any unexpected URL.
What happened
ChatGPT’s public share pages render conversation content, including mathematical notation and other rich HTML, in a preview that is supposed to stay sandboxed. Parameter’s write-up, as described in follow-on coverage, traces a chain through a permissive message listener in MathLive and raw HTML keyboard-layout data that let script run with the privileges of chatgpt.com. Once that happened, a visitor who was already signed in could have private conversations read by the attacker who crafted the shared link.
This is a different bug from Check Point’s Lockdown Mode bypass, which OpenAI had already patched in September by tightening iframe popup permissions. Both are sandbox escapes around ChatGPT’s web preview, and both are now closed.
What you should do
- No patch is required on the user side; OpenAI deployed the fix on October 26.
- If you clicked untrusted ChatGPT share links while signed in before that date, there is no public evidence in these reports that your account was targeted, but it is reasonable to review account sessions and treat unexpected shared links like unexpected email attachments.
- This is a reminder to open unfamiliar share links in a separate browser profile, or while signed out, especially when they come from strangers.
What it means
“Share this chat” is a distribution channel. If the shared page can run script as the product origin, it becomes an account-takeover and data-exfiltration path for anyone who can talk a signed-in user into clicking. OpenAI’s nine-day fix window and P1 classification match the severity. Combined with the Lockdown Mode research published in November, it has been a rough season for ChatGPT’s preview sandboxes — and a good argument for treating those previews as an attack surface, not as a cosmetic feature.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on Parameter’s public research post, The Hacker News’ October 2026 coverage, and The Injection’s week-44 summary. i10x did not reproduce the share-link escape.
