A ChatGPT Link Could Read Your Private Chats

In a test by the security firm Parameter, an ordinary public ChatGPT share link ran the attacker's code in the signed-in web session of whoever opened it. Parameter says the code listed a test victim's recent conversations, opened a private chat never shared with the attacker, and sent a small piece of it to an outside server. Parameter says OpenAI fixed it on October 26, 2026, so this is about the past, not a warning. The Hacker News says ChatGPT users do not need to do anything.