When a flaw in a popular AI tool is fixed before most people hear about it, the right reaction is not alarm but a quick check of your own habits. On 28 October 2026 the security firm Parameter published a write-up showing that a public ChatGPT share link could be turned against the person who opened it. OpenAI has already fixed the problem. This guide explains what was reported, why it matters even though no action is needed from ChatGPT users, and the policies a small business can put in place around AI chats. We have not tested the flaw and do not describe how to reproduce it.
The shared-link feature turns a private chat into a public web page that anyone with the link can open. Image: ChatGPT by OpenAI, public domain, via Wikimedia Commons
The short answer
- What was reported: Parameter says an ordinary public ChatGPT share could be built so that, when a signed-in person opened it, the attacker's code ran in that person's ChatGPT session.
- What it could do: in a controlled test between separate accounts, the code listed recent conversations and read a private chat that had never been shared. Parameter says it could perform any action on the victim's account.
- Status: Parameter says OpenAI fixed it on 26 October 2026 and rated it P1. The Hacker News reports that users need to do nothing.
- Exploitation: neither source reports real-world use. The test was a controlled research exercise.
The takeaway for a business is not "patch now" but "decide how your team uses AI chats and shared links".
What was reported, in plain terms
According to Parameter, the researchers submitted the report to OpenAI's bug bounty programme on 18 October 2026. OpenAI reproduced it on 21 October and raised the severity from an initial P2 rating to P1. One of ChatGPT's two web frontends was fixed first, with the second following, and on 26 October OpenAI confirmed both rejected the messages the report relied on and marked the issue resolved. Parameter published its write-up on 28 October, after the fix, and The Hacker News reported that OpenAI paid a total of 5,000 US dollars.
The mechanism, at a high level, was a chain of features that were each reasonable alone. ChatGPT can turn a block of code into a small preview page, and it runs that preview in a separate, restricted frame so it cannot read the main page. A graph feature in the same conversation loaded a maths library that listened for messages from other frames. Parameter says that listener did not sufficiently check who was sending a message, which let the restricted preview pass content across a boundary that was meant to hold. We are deliberately leaving out the specifics, which are in the researchers' own write-up for anyone who needs them.
Parameter's own lessons are general ones worth remembering: a receiver of cross-window messages should check both the sender and the exact window, settings passed between windows should not carry raw HTML, and a content security policy should be a backup control and not the only barrier.
Why it matters even though it is fixed
Three reasons stand out for a small or mid-size business.
- Chats can hold more than you think. Staff paste in contracts, customer details, code and financial figures. Parameter notes that code in the victim's session could reach private conversations and files, which is a reminder of how much sits behind one login.
- A link is an invitation. The attack began with a link that looked like any other shared chat, and could be sent by email, chat message, support ticket or social post, according to The Hacker News. Shared AI chats are now part of everyday business communication, and people trust them.
- Fixes on the vendor side are invisible. You cannot patch ChatGPT's web app yourself. What you control is what goes into it and how your team handles links.
What to do this week
You do not need to stop using AI tools. A short, written set of rules covers most of the risk.
- Decide what must never go into an AI chat. Typical examples are customer personal data, passwords and keys, unreleased financial results and client contracts. Write the list and share it.
- Check which plan your team is on. Business and enterprise plans from AI vendors usually differ from personal ones on data handling and admin controls. Read the vendor's current terms rather than assuming.
- Treat shared AI chat links like any external link. Open them from people you know, and be wary of ones that arrive unexpectedly in a support ticket or message.
- Review old shared links. Most AI tools let people see and delete the chats they have shared. Ask staff to remove links they no longer need.
- Turn on two-step sign-in for AI tool accounts, and use company-managed accounts instead of personal ones for work.
- Name an owner. One person should track which AI tools are in use and what each one can access.
If you are building AI features into your own product, the same design lesson applies to your code: anything that passes messages between parts of a page should verify where the message came from. Our AI automation service can help review where AI tools touch your data, and our guide to AI for small business covers practical, lower-risk uses.
Related risks to keep in mind
This is not the only way AI tools reach a business. Earlier this week we covered fake ChatGPT and Claude desktop apps that install malware, which is a different problem with a similar fix: only use official apps and sign in through accounts the company controls. And if you give AI agents access to email, files or payments, our explainer on AI agents for business covers why narrow permissions and human approval matter.
Checklist for your team
- Write a one-page list of data that must never be pasted into an AI chat.
- Confirm which AI tools and which plan types your team uses.
- Move work use to company-managed accounts with two-step sign-in.
- Ask staff to review and delete shared chat links they no longer need.
- Tell staff to treat unexpected shared-chat links like any unknown link.
- Keep API keys, passwords and customer personal data out of chats.
- Name one person responsible for AI tool access and policy.
- Re-read vendor security and data terms when you renew or change plans.
- Review the policy again after any major AI security story.
Common mistakes to avoid
Assuming a fixed flaw means no follow-up. The fix removes this issue, not the habit of pasting sensitive data into chats.
Treating shared links as safe because they come from a known service. The link is only as trustworthy as the person who sent it.
Using personal accounts for work. You cannot review or remove access to an account your company does not control.
Banning AI outright. Staff will use it anyway. A clear policy is safer than a ban that pushes it out of sight.
Over-reading the story. Neither source reports real-world abuse, so avoid headlines that suggest accounts were taken over.
Key takeaways
- Parameter reported that a malicious ChatGPT share link could run code in a viewer's signed-in session and read private chats; OpenAI fixed it by 26 October 2026 and rated it P1.
- ChatGPT users do not need to patch or reset anything, and no real-world use has been reported.
- The lasting lesson is about habits: what goes into AI chats, how links are treated and who owns AI tool access.
- A one-page policy, company-managed accounts and two-step sign-in cover most of the risk.
Want help drawing up an AI tool policy or checking where AI touches your data? See our AI automation service or talk to our team.
Sources
- Parameter: Do the Math: How We Took Over ChatGPT Accounts (28 October 2026)
- The Hacker News: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats (31 October 2026)
Last reviewed 31 October 2026. This article is general information, not a guarantee of protection. Details come from the researchers and a news report and may change, so confirm them with OpenAI's own notices.
