Malicious ChatGPT Share Link Can Execute Code in Victim Sessions and Read Private Conversations
What Happened — Researchers at Parameter discovered that a specially crafted ChatGPT “share” link can run attacker‑controlled JavaScript in the browser session of any logged‑in user who clicks it. The injected code can harvest the victim’s authentication cookies and read the contents of private ChatGPT conversations. OpenAI was notified through its bug‑bounty program on 18 Oct 2026; the flaw was classified as P1 (critical) and patched eight days later. No public evidence of the vulnerability being abused in the wild has been reported.
Why It Matters for Trust & Control Assurance — The issue highlights a gap in session isolation and access‑control safeguards for AI‑driven SaaS platforms, a control area that maps to AI‑governance objectives in the NIST AI RMF.
Who Is Affected — Any organization that allows employees or customers to use ChatGPT, especially those that rely on the share‑link feature for collaboration (technology SaaS, professional services, education, media, etc.).
Recommended Actions
- Enforce multi‑factor authentication and review session‑management settings for all AI‑tool accounts.
- Log and monitor usage of share links; flag anomalous link clicks for investigation.
- Update internal policies to treat shared AI links as untrusted content and educate users on safe handling.
- Verify that the latest OpenAI patch is applied across all integrations.
Technical Notes — The flaw is a client‑side code‑execution vulnerability triggered by a crafted URL (effectively a stored XSS in the share‑link workflow). No CVE ID has been assigned yet. Exploited data includes authentication tokens and the text of private chats. Source: The Hacker News