Security researchers at Parameter disclosed a vulnerability in ChatGPT’s share link feature that could have let an attacker execute arbitrary code inside a victim’s authenticated session simply by getting them to open a malicious link.

According to the researchers, the flaw meant that opening a shared ChatGPT conversation link crafted by an attacker could trigger code execution within the context of the logged-in user’s session. Because the code would run under the victim’s own authenticated session, an attacker could potentially access and read that user’s private chat history.

How the Flaw Was Found and Fixed

Parameter reported the issue to OpenAI through the company’s bug bounty program on October 18. OpenAI moved quickly, issuing a fix eight days later. The company classified the bug as P1, its highest severity rating, reflecting the seriousness of a flaw that could expose private user data and allow unauthorized code execution through a simple shared link.

Why Share Links Are a Risky Attack Surface

Share links are a convenient way for ChatGPT users to send conversations to others, but they also represent a trust boundary that users may not think twice before crossing. A victim clicking a shared link typically expects to view a conversation, not expose their own session to attacker-controlled code. This class of vulnerability, where a feature designed for convenience becomes a vector for session hijacking or data exposure, underscores the risks inherent in AI platforms that blend user-generated content with authenticated application state.

  • The vulnerability allowed attacker code to execute in a victim’s logged-in ChatGPT session.
  • Exploitation could expose a victim’s private conversation history.
  • Parameter reported the bug through OpenAI’s bug bounty program on October 18.
  • OpenAI patched the issue eight days later and rated it P1, its most severe classification.

No evidence of in-the-wild exploitation was mentioned by the researchers or OpenAI. The rapid turnaround between disclosure and patch highlights the value of structured bug bounty programs for catching serious flaws in widely used AI products before they can be weaponized.

Users of ChatGPT and similar AI assistants should remain cautious about clicking shared links from untrusted sources, even on platforms they otherwise trust, since such links can carry hidden risks tied to the underlying web application rather than the AI model itself.