Signals · Rising · first seen October 31, 2026
A now-fixed ChatGPT flaw let a shared link read private chats in the viewer's account
Researchers at Parameter showed that a booby-trapped ChatGPT shared conversation could run code inside the signed-in viewer's session, list their chats and pull one that was never shared. They reported it through OpenAI's bug bounty on Oct. 18, and OpenAI had fixed it on its side by Oct. 26, MIXED reported on Nov. 1. Users do not need to do anything for this flaw, and no attack on real accounts has been reported.
Why it matters to a business like yours
Staff paste customer names, job notes and draft prices into ChatGPT, and a link on a familiar address can still carry a trap. Remind your team to open shared chat links only from people they know, and to keep customer details out of AI chats where they can.
Sources
- "Opening the shared link was the only required action": ChatGPT privacy flaw is fixed (MIXED, November 1, 2026)
- ChatGPT flaw let a shared link read your private chats (Notebookcheck, November 2, 2026)
History
- November 2, 2026: Rising