One shared ChatGPT link was enough to read a victim's private chats. OpenAI fixed it and paid $5,000

A public ChatGPT share link could run code in your signed-in session and read chats you never shared.

What happened

Parameter Labs found a way to turn an ordinary public ChatGPT share into JavaScript running as chatgpt.com in the session of whoever opened it. The chain combined two features that looked harmless alone. A normal interactive graph loaded the MathLive library, which installed a message listener in the main ChatGPT page. An HTML Preview, running in its own sandbox, could send that listener a message with raw HTML, and MathLive accepted messages from any origin. That HTML created an unsandboxed frame, and an allowed YouTube endpoint was used to get around ChatGPT's script rules.

In their proof, the code listed the victim's recent conversations, pulled content from a private chat and sent part of it to an outside server. In the automatic version, opening the link was the victim's only click. OpenAI rated it P1, confirmed the fix on October 26, and paid a $5,000 bounty. Simon Willison called that "a bit cheap for a vulnerability this serious."

My take

The bug is fixed, so this is not a panic post. It is a reminder of where the risk actually sits for small teams.

In many small businesses, staff paste client details, invoices and CRM exports into ChatGPT. Their chat history is a quiet database of customer data with no retention policy.

Practical steps:

1. Treat shared AI chat links like email attachments from strangers.
2. Keep client PII out of consumer chat apps. Route that work through an automation or a business plan with admin controls.
3. Set a history and retention rule for AI tools, the same as for email.
4. When you build anything that renders user content, check every message listener for who sent it, as the researchers recommend.

The researchers' lesson applies to every stack: each feature looked safe, and the hole lived in the seams between them.