Until 26 October, opening a shared ChatGPT conversation could hand a stranger your private chats

A shared ChatGPT conversation looks like the most harmless link on the internet. It's someone's chat, sitting on chatgpt.com, read-only. Researchers at the security firm Parameter have shown that until last week, opening one could hand a stranger control of your account.

The trick chained three small mistakes together. ChatGPT can draw interactive graphs, and the maths library behind them, MathLive, accepted instructions from any part of the page without checking who sent them. Those instructions could carry raw HTML, and that HTML could build a frame the browser treated as part of chatgpt.com itself. From there, the researchers' code ran inside the victim's signed-in session. In their tests it listed recent conversations, opened a private chat that had never been shared, and sent a slice of it to a server they controlled. "Essentially, we could perform any action on behalf of the victim's ChatGPT account," they wrote. The first version needed one click on the Preview button. A later one needed nothing beyond opening the link.

The reassuring part is the timeline. Parameter reported the flaw through OpenAI's bug bounty programme on 18 October, OpenAI raised it to P1, its most serious rating, and both versions of the web app were fixed by 26 October. The researchers were paid $5,000 and say they only ever tested against their own accounts, with no sign of anyone else using the bug. You don't need to install or reset anything. The lasting point is about habits. A link to a site you trust can still carry content written by someone you don't, and an AI chat history often holds more personal material than an inbox. If yours does, give it the same protection as your email: a unique password and two-step sign-in.

Tendvane's Privacy & accounts check is a quick way to go over which of your accounts are well protected and which deserve a second look.