If your staff paste contracts, customer lists or prices into ChatGPT, this flaw concerns you. On October 28, 2026, researchers at Parameter disclosed that a single public share link to a ChatGPT conversation was enough to run an attacker's code inside the account of whoever opened it, read their private chats and act in their name. OpenAI closed the hole on October 26, and you do not need to update anything. The question that remains is yours: what would an attacker have read in your staff's chat history? Here are 5 steps to review this week.
What exactly happened
Share links are a feature everyone uses: you copy a link to a conversation and send it to a colleague or a client. The researchers found that ChatGPT's graph feature loaded a math library called MathLive, and that this library accepted messages from any frame on the page without checking where they came from. Chained with the HTML Preview feature, this let anyone who built and shared a malicious conversation run their code as chatgpt.com itself.
According to the writeup, the code could:
- List the victim's recent conversations.
- Read a private conversation the victim had never shared with anyone.
- Send selected data to an external server.
- Call ChatGPT's APIs as the victim, which the researchers described as effectively taking over the account.
The interaction required from the victim was minimal: in the most stable version of the attack, one click on the Preview button; in a later version, opening the link was enough. No app to install, no password to enter.
The timeline in figures
- October 13, 2026: the researchers confirmed the path against the live site.
- October 18: they reported it to OpenAI through its bug bounty program.
- October 21: OpenAI reproduced the flaw and raised its severity from P2 to P1.
- October 22 and 23: one of 2 web frontends was fixed, then security policy changes blocked part of the chain.
- October 26: OpenAI confirmed both frontends reject the exploited messages and resolved the report.
- October 28: the researchers published the details and said the bounty came to $5,000.
Ostorlab's analysis notes that no CVE was assigned and that no real-world abuse has been reported, but any signed-in user who opened a crafted link before October 26 was a potential victim.
Why this matters to a business owner
Because the real risk is not the link but what the chat history holds. A salesperson's ChatGPT history may hold quotes and client names, an accountant's holds financial figures, and a developer's holds integration keys and pieces of system code. Any flaw that opens that history opens your company's secrets with it, even if the employee never shared anything themselves.
OpenAI's official help page explains that anyone who has a link created from a personal account can view its content, while a link created inside a ChatGPT Business, Enterprise or Edu workspace can be opened only by eligible members of that workspace. That difference is worth knowing about where your staff work: in personal accounts or in a workspace the company manages. We wrote earlier about how to protect your company from AI risks, and this flaw is a practical example of it.
5 steps to review this week
- Know who uses ChatGPT, and on which account: a simple list of staff names, and whether each works from a personal account or the company workspace.
- Write a rule for what never goes into ChatGPT: customers' personal data, contracts, passwords and system integration keys. A written rule is stronger than a verbal reminder.
- Clean up history and old links: delete conversations that hold sensitive data, and review your links under Settings, then Data controls, then Shared links, then Manage. OpenAI points out that deleting a link stops future access but does not delete the original conversation or copies others have already saved.
- Treat share links like attachments: a ChatGPT link from a sender you do not know deserves the same caution as an unknown file. The attack needed a signed-in session, so opening a suspicious link in a browser that is not signed in to your account limits what it can reach.
- If you have an Enterprise workspace: the workspace admin can turn off conversation sharing under Workspace settings, then Permissions and roles, if your team does not need it.
The Origami view
We read this flaw as a reminder that AI tools have become a store of company secrets without anyone deciding so. Staff paste what they need to get their work done, the history grows day after day, and nobody reviews it. The answer is not to ban the tool, but to decide what goes into it and on which account.
There is a second lesson for technical teams: the flaw started in a third-party library that accepted messages without checking their source. When we build a custom system that displays content from outside sources, we verify the origin of every message between frames and isolate untrusted content, rather than relying on browser restrictions alone.
Conclusion
The flaw was closed on October 26 and needs no update from you, but it showed that your staff's chat history may be the most valuable file in your company. Set aside an hour this week: a list of accounts, a written rule for what is never pasted, and a clean-up of history and links. If you want a review of how your team uses AI tools, contact us or see our services.
Sources
- Parameter — Do the Math: How We Took Over ChatGPT Accounts, October 28, 2026: the exploit chain, the timeline, what the attacker could do and the bounty.
- OpenAI Help Center — Sharing conversations and scheduled tasks in ChatGPT: who can view a link, managing and deleting links, and the sharing permission in workspaces.
- Ostorlab — ChatGPT Shared-Link Account Takeover via MathLive Sandbox Escape: the fix date, the absence of a CVE and of abuse reports, and recommendations for developers.
Frequently asked questions
Do I need to update ChatGPT to close the flaw?
No. The fix was made on OpenAI's own sites, and the company confirmed on October 26, 2026 that both web frontends reject the exploited messages. What remains for you is reviewing what your staff's chat history holds.
Was the flaw actually exploited against users?
According to Ostorlab, no real-world abuse has been reported and no CVE was assigned. But any signed-in user who opened a crafted link before October 26 was a potential victim.
How do I delete old share links in ChatGPT?
Go to Settings, then Data controls, then Shared links, then Manage, where you can delete one link or all of them. Deleting stops future access but does not delete the original conversation or copies others have saved.
Should I ban my staff from using ChatGPT?
A ban usually pushes staff to personal accounts you cannot see. A better approach is a written rule for what never goes in, such as customer data, contracts and passwords, with company-managed accounts where possible.
