ChatGPT Shared Link Vulnerability Allowed Private Chat Access

A critical security flaw in OpenAI’s ChatGPT allowed malicious shared links to execute attacker code within a user’s logged-in session, potentially exposing their private conversations. Researchers at the security firm Parameter discovered the vulnerability, which OpenAI quickly addressed.

The flaw, rated by OpenAI as P1 – its most serious category – was reported through the company’s bug bounty program on 18 October. OpenAI confirmed a fix for the issue just eight days later, on 26 October.

Parameter’s findings demonstrated that simply opening a specially crafted ChatGPT share link could compromise a user’s session. This unauthorised code execution would grant an attacker the ability to read the victim’s confidential chats and potentially perform other actions within their ChatGPT account.

The rapid classification as P1 and subsequent swift patch highlight the severe privacy implications of the vulnerability, which could have led to widespread unauthorised access to sensitive user data within the popular AI chatbot platform. Users are reminded to exercise caution when clicking on unfamiliar links, though the prompt action by OpenAI has mitigated this specific threat.