Researchers at the cyber-security firm Parameter identified a serious flaw in ChatGPT that allowed a specially crafted link to expose a user’s private conversations. OpenAI rated it P1 — the company’s highest severity classification — and fixed it after being told.
The flaw was found through OpenAI’s bug bounty programme, which is the detail that makes this a story about a system working rather than a system failing.
What the attack required
Very little, which is the point. The malicious link could be spread by email, by message, or in a social media post. Opening it and pressing ChatGPT’s “Preview” button once was enough to run the attacker’s code.
Note what was not required. The victim did not have to install any software. They did not have to join a particular workspace. They did not have to sign in again, or approve anything that looked like a permission request. There was no moment at which a careful user would have been prompted to stop and think.
Why it worked
The technique is the interesting part. The malicious code did not scrape what was displayed on screen, which is what most people imagine when they picture an attack on a chat window and which is comparatively easy to detect.
Instead it used ChatGPT’s own signed-in API — the interface the product itself uses once you are logged in. Because the request came through the user’s own authenticated session, it carried their authority. That opened the way not only to reading information through the account but to carrying out actions with it.
This is a familiar shape of bug wearing new clothes. The underlying error is confused authority: code supplied by a stranger ends up executing with the privileges of the person who clicked. What is new is where it lives, because an AI assistant is unusually attractive ground for it. The whole product is built to take instructions from text, and the text is supplied by whoever is talking to it.
What was at stake
Private conversations. People put a great deal into these systems that they would not put into a public document: draft messages they have not sent, medical worries, financial details, work material covered by agreements they have signed, and the half-formed thinking that is the reason to use an assistant at all.
A P1 rating reflects that. It is not a measure of how clever the technique was but of what it reached.
What this does not tell you
It is worth being precise about the limits of the report, because a flaw story and a privacy story are easy to conflate.
This says nothing about how long OpenAI retains conversations, how they are encrypted at rest, what happens when a government or a court asks for them, or which settings change any of that. Those are real questions with real answers, and they live in the company’s privacy policy and data controls rather than in a vulnerability report.
What the report does establish is narrower and more immediate: for a period, a stranger with a link could read what you had typed.
The practical lesson
Nothing here is fixable by user caution, which is precisely why it was rated so highly. The flaw has been patched, so there is no action to take.
The habit worth keeping is the general one: a link that arrives unexpectedly and wants a single click inside a tool you are already signed into is the shape of a great many attacks, whether or not an AI assistant is involved. The reason it works is never that the victim was careless. It is that the click happened inside a session that was already trusted.
