Parameter Researchers Discover Critical Vulnerability in ChatGPT Share Links

A security research team from the firm Parameter disclosed a significant vulnerability in OpenAI's ChatGPT service. The researchers demonstrated that a malicious ChatGPT share link could execute arbitrary code within the context of a victim's active session. By enticing a target to open such a link, an attacker could potentially gain access to read private conversation histories. The researchers responsibly disclosed the flaw through OpenAI's bug bounty program on October 18, 2026. OpenAI acknowledged the severity of the issue and released a fix eight days later, rating the vulnerability P1, the program's most serious category. The prompt action by OpenAI to address the flaw highlights the potential risks associated with shared links in AI platforms. While the specific technical vectors of the exploit have not been detailed publicly beyond the code execution capability, the incident underscores the importance of rigorous input validation and session management in large-scale web applications. No confirmed reports of active exploitation in the wild have been attributed to this specific vulnerability prior to the patch.