One link, all your private chats: how AI assistants get turned against you

The ChatGPT shared link that read your private chats

In October 2026, a single ChatGPT share link was enough to take over the account of anyone who opened it. Researchers at the security firm Parameter found the flaw and reported it to OpenAI's bug bounty program on October 18. OpenAI shipped a fix eight days later, rated the bug P1 (its highest severity), and paid $5,000 for the report (The Hacker News).

The trap looked like any other shared conversation. An attacker could send it by email, in a chat, inside a support ticket, or in a social media post. The victim installed nothing and never signed in to anything the attacker controlled. In the most reliable version, they opened the link and clicked ChatGPT's Preview button once. A later version opened Preview automatically, so opening the link was the whole attack.

After that, the attacker's code ran inside the victim's logged-in ChatGPT session with the same access as the real site. In Parameter's test it listed recent conversations, opened a private chat that had never been shared, and sent part of it to a server the researchers controlled. The researchers wrote that they could take any action the victim's account could take (Parameter's writeup).