Researchers at Parameter discovered a vulnerability in ChatGPT that allowed attackers to run code in a user's session via a shared link, potentially accessing private conversations.
The vulnerability or weakness
The vulnerability involved the Preview feature, which loaded code into the main ChatGPT page, bypassing the sandbox.
Earlier attacks and coverage
- Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls (2026-10-29)
- Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers (2026-10-28)
- Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads (2026-10-24)
- Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions (2026-10-22)
- Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers (2026-10-19)
Business impact
Organizations with employees using ChatGPT may face risks of data exposure if the tool is integrated in their operations or if employees share links carelessly.
Industries affected
The incident affects organizations across various sectors, particularly those that rely on ChatGPT for communication or research purposes.
Users affected
Users of ChatGPT are at risk if they open shared links, as their private conversations could be read by attackers who exploit the vulnerability.
