A ChatGPT Link Is Still a Link
A fixed flaw, a malware trick on real chatgpt.com pages and a new lock for private chats. Three rules your staff need this week.
By John Martines · November 3, 2026 · 6 min
Researchers showed a shared ChatGPT link could open someone's private chats, and attackers have used real ChatGPT pages to deliver malware. Meanwhile ChatGPT added locked chats with a catch. Here is what to tell your team.
A text comes in to the front desk of a dental office. It's from a number the receptionist doesn't know, and it says: "Here are the new insurance codes we talked about," followed by a link that starts with chatgpt.com. ChatGPT is a name she trusts. The office uses it every day. She taps it.
For most of this fall, that tap was riskier than it looked. In one case, simply opening a crafted link could have let a stranger read her own private ChatGPT chats. In another, a real ChatGPT page walked people step by step into installing remote-control software for an attacker. Both are worth ten minutes, and so is a new ChatGPT feature that changes what "private" means on a shared computer.
A shared link is ChatGPT's way of letting you send someone a copy of a conversation. Anyone with the link can read it. That makes it handy for passing work around the office, and handy for attackers, because the link sits on chatgpt.com, a site people and email filters already trust.
Three separate things happened.
A flaw that's now fixed. Researchers at the security firm Parameter showed that a specially built public ChatGPT link could run their code inside the signed-in session of whoever opened it. In their test, it listed the victim's conversations and pulled up a private chat that had never been shared. The weak point was MathLive, a tool ChatGPT used to show interactive math and graphs, which accepted instructions without checking where they came from. Their first version needed one click on Preview; a later one needed only opening the link. OpenAI fixed it on October 26, 2026 and rated it top priority. The researchers showed it in a lab; there is no sign it was used against real people. The fix is on OpenAI's side, so there is nothing for you to install.
A trick that needs no flaw at all. Attackers have posted real shared ChatGPT conversations that show a fake "high traffic" notice. It sends Windows users to a lookalike backup site, which copies a command to their clipboard and tells them to paste it and run it. That one paste installs NetSupport, a legitimate remote-control program, so the attacker can drive the computer. Security people call this pattern ClickFix: the victim installs the malware themselves, by following instructions. ChatGPT itself wasn't hacked; the page was just a trusted place to start.
A new lock with a catch. Since October 20, 2026, OpenAI has been rolling out locked chats. You lock a conversation from its menu, it disappears from your history and search, and it opens only with a four-digit PIN (or Face ID, Touch ID or your phone's unlock). It's on every plan from Free to Enterprise, but not ChatGPT for Healthcare. The catch: if you forget the PIN and reset it, every locked chat is deleted for good. OpenAI support can't bring them back, and a workspace admin can't unlock them or reset the PIN.
How it got here:
- August 2025: OpenAI removed an option that let shared chats be found in search engines, after people's shared conversations turned up on Google.
- About September 1, 2026: researchers reported real ChatGPT share pages being used as the first step of the NetSupport attack.
- September 29, 2026: Huntress reported a related trick using custom GPTs on chatgpt.com to lead people into the same kind of paste-this-command attack.
- October 20, 2026: locked chats started rolling out.
- October 26, 2026: OpenAI fixed the share-link flaw Parameter reported; coverage followed in late October and early November.
"chatgpt.com" in a link is not a safety sign. Staff are trained to be careful with odd domains. A link to a site they use daily slips past that instinct, and past many email filters too.
Your team's chats hold real business. Bids, supplier quotes, employee issues, client details. A flaw that reads private chats is a flaw that reads those. It's fixed, but the next one won't announce itself.
On a shared computer, "locked" can mean "lost." Locking is a useful privacy screen at a front desk where several people use one machine. But OpenAI says a locked chat is not encrypted and doesn't change how long OpenAI keeps it. It just hides it. And if the person who locked it forgets the PIN, your company's work in those chats is gone, with no admin override.
1. Teach the one rule that stops ClickFix. No website, chat page, captcha or "verification step" ever needs you to paste something into the Windows Run box, PowerShell or the Mac Terminal. If one asks, close it and tell someone. Say it at your next staff meeting and put it in writing.
2. Treat a shared chat link like an attachment. Open it only when you expected it from someone you know. If it arrives out of the blue, check with the sender by phone or a separate message before you tap. Our piece on [fake AI app downloads](/articles/fake-ai-app-downloads) covers the same habit for apps.
3. Clean up your own share links. In ChatGPT, go to Settings, then Data controls, then Manage next to Shared links. Delete any you no longer need. Deleting a link stops new viewers, though anyone who already saved a copy keeps it.
4. Set a rule for locked chats. A good one for most offices: "Lock personal or sensitive chats if you like, but anything the business needs goes in a shared project or a saved document, never only in a locked chat." Ask anyone who locks chats to keep their PIN somewhere safe, like the company password manager.
5. Keep everyone on their own login. If several people share one ChatGPT account at the front desk, one person's locked chats and shared links become everyone's problem. Separate company seats make it clear whose chats are whose.
- Has every staff member heard, in plain words, "never paste a command a web page gives you"?
- Does your team know to confirm an unexpected chatgpt.com link with the sender first?
- Has someone reviewed the shared links on the company's ChatGPT accounts this month?
- Is there a written rule that business work never lives only in a locked chat?
- Does each person who uses ChatGPT for work have their own company login?
The AI assistants are becoming places where real work lives, so they're becoming places attackers aim at. Expect more of both patterns: flaws that the vendor fixes quietly, and tricks that borrow a trusted address and let the victim do the rest. The vendors can patch the first kind. Only your staff can stop the second.
The good news is the habits are old ones. Don't trust a link because of the name in it, don't run a command a web page hands you, and keep company work where the company can reach it. Write those three down this week, and the next headline about a ChatGPT link will be a story, not a cleanup.
---
Sources (checked November 3, 2026). Share-link flaw, how it worked, the MathLive cause, one click or none, fixed October 26 and rated P1, lab demo only: Parameter's research write-up (Oct 2026), as reported in "Researchers Discover High-Severity ChatGPT Flaw That Exposed Private Conversations to Attackers" (GBHackers, Nov 2026), "Critical ChatGPT Flaw Allowed Attackers to Hijack Accounts and Steal Private Conversations With One Link" (Cybersecurity News, Nov 2026) and Mixed (Nov 2026). Real ChatGPT share pages used for a ClickFix attack delivering NetSupport, not a breach of chatgpt.com: "Hackers Abuse Legitimate ChatGPT Shared Links to Deploy NetSupport RAT" (GBHackers, Sept 2026) and "Hackers Abuse Real ChatGPT Links to Trick Windows Users Into Installing Malware" (Cybersecurity News, Sept 2026). Custom GPTs used for ClickFix: Huntress, "Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix" (Sept 2026), as reported by Cybersecurity News (Sept 29, 2026) and BleepingComputer (Sept 2026). Locked chats, PIN, plans, rollout from October 20, no encryption, PIN reset deletes locked chats, no admin override: OpenAI Help Center, "Using locked chats in ChatGPT" (checked Nov 3, 2026); coverage in Notebookcheck and Tech Times (Oct 2026). Managing shared links: OpenAI Help Center, "Data controls in ChatGPT" (checked Nov 3, 2026). Shared chats removed from search engines: AlternativeTo (Aug 2025).