ChatGPT shared link flaw, fixed Oct. 26

A flaw in ChatGPT's shared conversation pages could let an attacker run code inside your signed-in ChatGPT session, security firm Parameter says. OpenAI fixed it on Oct. 26. In its write-up, Parameter lists the status as Fixed and the severity as P1.

What the bug did

An attacker would publish a normal public ChatGPT shared conversation. When a victim opened that /share/ link while signed in, the attacker's JavaScript ran as chatgpt.com in the victim's session.

Parameter showed it could list a victim's recent conversations and fetch a private conversation that was never shared with the attacker. It also sent a small piece of that conversation to a server it controlled. Parameter wrote: "essentially, we could perform any action on behalf of the victim's ChatGPT account." It says the reach was not limited to conversation endpoints.

Parameter describes a chain of weaknesses. A math keyboard component loaded into the page accepted messages without checking who sent them. A sandboxed preview frame could pass it content that ended up in the page. Parameter says YouTube was a workaround for ChatGPT's content security policy, not the root cause. We are not describing the steps further.

How much the victim had to do

Parameter says its most stable version needed one click on a Preview button. A later version opened Preview automatically, so opening the shared link was the only action. Parameter reproduced it, with a test alert appearing after about 4.5 seconds.

Timeline

According to Parameter:

Oct. 18: Parameter reported the issue to OpenAI's bug bounty program.
Oct. 21: OpenAI reproduced it and raised the severity from P2 to P1.
Oct. 22: One web frontend was fixed. A second was in progress.
Oct. 23: Content security policy changes blocked part of the chain.
Oct. 26: OpenAI confirmed both frontends rejected the reported messages and resolved the issue. It awarded a total bounty of $5,000.

Parameter published its write-up on Oct. 28. The Hacker News also covered it.

What this means for you

It is fixed. Parameter lists the issue as fixed, and says OpenAI resolved it on Oct. 26. The fix was in ChatGPT's web frontend.
Nothing to do. Parameter's write-up does not ask users to do anything, and The Hacker News says users need not act.
No known attacks. Parameter tested between its own accounts. Neither source reports it being used against real users.
Shared links are still links. A shared conversation is a page anyone can publish. This bug shows why opening one while signed in is not risk free.

For another ChatGPT privacy story, see ChatGPT locked chats hide history, not data. For a different sharing problem, see Meta pauses Muse chat sharing after shared links turned up in DNS records. More is in AI & Apps.