One shared ChatGPT link could take over your account. Is ChatGPT safe, and why did OpenAI pay only $5,000?

Until 26 October 2026, opening the wrong shared ChatGPT link could hand a stranger your whole ChatGPT account. A security firm called Parameter showed that a normal-looking public ChatGPT share could run an attacker's code inside your logged-in session. That code could list your chats, read a private chat you never shared and send it to the attacker's server. Parameter says it could take any other action you can take on the site, too. In the best version of the attack, opening the link was the only thing the victim had to do. The bug was first rated P2, then raised to P1, the most serious level. It fixed the bug on 26 October and paid a total bounty of $5,000.

So is ChatGPT safe? Today, against this bug, yes, because it is fixed and you do not need to do anything. But I read Parameter's full write-up, and the lesson is bigger than one bug. The AI model was never the weak spot. The weak spot was ChatGPT turning into a small web browser full of features, previews, graphs and apps, with every new feature opening another door into the place where people keep their most private conversations. And $5,000 is too little for a one-click way into that place.

What happened with the ChatGPT shared link?

Mukul Goyal and his team at Parameter published the details on 28 October in a post called "Do the Math: How We Took Over ChatGPT Accounts". Here is the attack in plain words.

ChatGPT has a Preview feature that turns HTML code in a chat into a small working web page. Because that page could contain anything, ChatGPT runs it in a locked box on a different web address, so it cannot reach into your account. That part worked.

ChatGPT can also draw interactive graphs. To do that, it loads a free maths library called MathLive into the main ChatGPT page. MathLive comes with an on-screen maths keyboard, and it listens for messages from other parts of the page about how that keyboard should look. The problem was that it did not check who was sending those messages.

So the attacker built one ordinary conversation with two things in it, a real graph and an HTML Preview. The Preview, sitting in its locked box, sent two messages to MathLive. The first said "here is a new keyboard layout", and the layout was secretly attacker code. The second said "show the keyboard". MathLive put the code straight into the real ChatGPT page.

ChatGPT had one more guard, a list of approved places scripts can load from, and YouTube was on that list. Parameter found that a YouTube address used for embedding videos would repeat text you gave it as working code. That last trick let their script run as chatgpt.com, with your login. A check on 1 November showed that YouTube address still repeats the text, so the fix had to come from ChatGPT's side.

After that, the attacker only had to share the chat the normal way and send the link to someone. Email, a chat app, a support ticket or a social post would all work.

What could an attacker see in your ChatGPT account?

Everything you can see. Parameter's test code read the session details the ChatGPT page already holds, then called ChatGPT's own systems as you. It pulled up your 20 most recent conversations, opened a private one that had nothing to do with the shared link, and sent a small piece of it to a server the researchers controlled. They sent only a small piece on purpose. The code had the full conversation and could have sent all of it.

Because the code ran as you, it was not limited to reading chats. Parameter says it could take any action on the account that the ChatGPT website allows, which is why they call it an account takeover. Think about what people keep in ChatGPT today: medical worries, money problems, work documents, code, contracts, files they uploaded. All of that sat behind one click.

Did you have to click anything?

Parameter saw two versions. In the most reliable one, the victim opened the shared link and clicked ChatGPT's normal Preview button once. The researchers then marked the code block so ChatGPT would open the Preview by itself. In that version, opening the link was the only action, and the attacker's code was running within about four and a half seconds. They repeated it three times in a separate account.

You did not need to install anything, join anything, paste anything or sign in to a fake page. The link was a real chatgpt.com link, which is what makes this kind of bug so effective. People trust links to sites they use every day.

Is $5,000 a fair bounty?

No. OpenAI runs its bug bounty on Bugcrowd, and its own published table pays $2,000 to $6,500 for a P1 bug in ChatGPT. So OpenAI paid this team less than the top of its own band for the most serious level. In a write-up published in February 2024, a researcher said OpenAI paid him $6,500 for an earlier ChatGPT account takeover that also went through the shared-link path. Years later, after OpenAI raised its top bounty from $20,000 to $100,000 in March 2025, a one-click takeover through the same door earned less.

Other big companies price this kind of bug far higher. Meta's rules say that "visiting a malicious link" counts as a one-click account takeover and pays up to $50,000. Google pays $20,000 when someone can run code in the browser on its most sensitive sites, like Gmail and Gemini.

To be fair, $5,000 is about ten times the average OpenAI payout, which is $484 across 669 rewarded bugs. But averages are pulled down by small bugs. This was not a small bug. It opened the private chats of anyone who clicked a link, in a product with hundreds of millions of users. When a company prices that at $5,000, it tells the next person who finds one what the work is worth to OpenAI. On Hacker News, where the write-up drew more than 300 points, the bounty was the biggest argument in the thread.

The library behind the bug was left open in 2023

MathLive, the free maths library at the centre of this, used to accept keyboard messages only from its own website by default. On 27 March 2023, its maintainer changed that default to accept messages from anywhere. The change sat inside a cleanup commit called "arch: simplify usage of globalThis", which says nothing about security, and it shipped the next day in version 0.90.8. It stayed that way for about three and a half years.

MathLive fixed it on 31 October 2026, three days after Parameter's write-up, in version 0.111.2. The new version only accepts messages from the same website again, and it no longer lets other windows send custom keyboard layouts at all. But there is no public security warning for this problem, no CVE number and no GitHub advisory. That matters, because the tools developers use to catch unsafe packages, like Dependabot and npm audit, only flag problems that have a warning on file. MathLive was downloaded about 1.07 million times in the month to 29 October, and it is built into maths plugins for popular text editors like CKEditor and Froala. Any of those apps that also shows other people's content in a frame on that page carries the same kind of risk until it updates.

OpenAI fixed its own site. The hole in the shared library stayed open for everyone else until the maintainer closed it, and nobody has said whether OpenAI or Parameter told the maintainer first.

Has this happened to ChatGPT before?

Yes, and the shared-link feature keeps coming up.

• March 2023: a bug in a database tool let some users see the titles of other people's chats, and may have exposed some payment details of 1.2 percent of ChatGPT Plus subscribers who were active during a nine-hour window. Full card numbers were not exposed.
• March 2023: researcher Gal Nagli found a way to take over ChatGPT accounts through a caching mistake. OpenAI fixed it within about two hours.
• February 2024: a write-up of another account takeover through a caching rule on the shared-link path, which earned a $6,500 bounty.
• July and August 2025: Fast Company found nearly 4,500 shared ChatGPT chats in Google search because of a "make this chat discoverable" option. OpenAI's security chief, Dane Stuckey, removed it and called it a "short-lived experiment".
• May 2026: Push Security found attackers using real chatgpt.com shared pages to show a fake outage notice and push a fake ChatGPT app download.

So the same door has been behind an account takeover, a privacy mess, a malware lure and now a one-click takeover in under three years. Fixing each case fast is good. It is not the same as fixing the door.

How to check and delete your ChatGPT shared links

You do not need to do anything about this bug, because OpenAI fixed it on its side. But it is a good moment to clean up what you have shared. These steps are from OpenAI's help pages as of 1 November 2026.

1. Open ChatGPT, then go to Settings, Data controls, Shared links and Manage. You will see every chat and scheduled task you have shared.
2. Delete any link you no longer need with Delete shared link, or remove them all with More actions and Delete all shared links. Deleting a link stops anyone from opening it. It does not remove a copy someone already saved to their own account.
3. Locking a chat does not delete its shared link, so delete the link separately.
4. If you clicked a strange link while logged in, go to Settings, Security and Log out all. OpenAI says it can take up to 30 minutes for other sessions to end.
5. Turn on two-step login under Settings and Security and login. It would not have stopped this bug, because the attack ran inside a session you were already logged into, but it stops a stolen password from opening your account.
6. Check Settings and Plugins for apps you have connected, like Gmail or Google Drive, and disconnect any you do not use.

Some people use ChatGPT at work through a Business or Enterprise plan. Links made inside those workspaces only open for people in the same company. But Parameter says its attack link also worked across separate workspaces, so work accounts were not safe from outsiders either.

"It was fixed in eight days. The system worked."

This is the fair case for OpenAI. Parameter reported the bug on 18 October. OpenAI copied the attack within three days, blocked part of it by 23 October, fixed it on 26 October, rated it P1 and paid. Nobody has reported a real victim.

I agree the fix was fast. But look at the rest. The bug was first rated P2. It only moved to P1 on 21 October, two days after the researchers added proof that a private chat could leave the account. To me, that says it took a stolen chat to show OpenAI that code running on chatgpt.com was serious. OpenAI paid less than its own top rate and less than it paid in 2024 for a similar bug. And OpenAI has said nothing in public. There is no statement, no line in the ChatGPT release notes and no note to users. Nobody has said whether anyone was hit. Parameter only tested between its own accounts, and it cannot see OpenAI's records.

Sam Altman said something at Stanford the same week that sums up the problem: "I no longer think we're going to be able to just patch all the bugs." If OpenAI believes that, then speed of patching is not the whole job.

Does this matter more in India?

Nothing ties this bug to India, since it hit any ChatGPT web user who opened a bad link. But India is where a lot of those users are. Sam Altman said in February that India has 100 million weekly ChatGPT users. OpenAI gave people in India a free year of ChatGPT Go if they signed up between 4 November 2025 and 21 January 2026, and those free years start ending on 4 November 2026. A lot of people in India are about to see messages about their plan ending. Scammers love moments like that, so treat any link about your ChatGPT plan with care and open your account by typing the address yourself.

What OpenAI should do

OpenAI should publish a short security note on this bug. It should say whether it checked old shared chats for this attack from before 26 October. It should say whether any Business or Enterprise workspaces were hit, and whether the ChatGPT desktop apps were open to it too. It should pay bugs like this at the top of its own range. And it should help MathLive get a public warning on file, so every other app that uses the library hears about it. People keep their health worries, money problems and work files in ChatGPT. When that place gets a one-click hole, the people inside it deserve more than silence.

My prediction

By 30 June 2027, another flaw in ChatGPT's sharing, preview or app features that lets one user read another user's private chats will be publicly reported and fixed. If I am wrong, I will say so here.

My reasons come from the history above. The shared-link path has failed in 2024, 2025 and 2026. OpenAI keeps adding features to the same page where your chats live, from previews and graphs to apps and plugins, and this bug came from two of those features meeting. More features means more places where two safe parts make one unsafe whole.

Questions people are asking

Is ChatGPT safe? For this bug, yes, because OpenAI fixed it on 26 October 2026 and you do not need to do anything. In general, ChatGPT is as safe as any big website, which means bugs do happen. Do not put anything in it you could not bear to see leaked, and delete shared links you no longer need.

Can someone hack your ChatGPT account with a link? Until 26 October 2026, yes. Parameter showed that one shared ChatGPT link could run code in your logged-in session and read your private chats. OpenAI has fixed that bug.

Can someone see my ChatGPT chats? Not normally. Other people can only see a chat if you share its link. This bug was an exception, because it let an attacker read private chats through a shared link they sent you.

Are ChatGPT shared links public? Anyone who has the link can open it. Shared links do not expire and have no per-person access control, and OpenAI says they are not meant for search engines but that does not make them private.

How do I delete shared links in ChatGPT? Go to Settings, Data controls, Shared links and Manage. Delete one link, or use More actions and Delete all shared links.