AI security risks turned from abstract concern to concrete exposure when researchers at Parameter discovered that a malicious ChatGPT share link could run attacker code inside a logged-in session and read private conversations. The flaw allowed attackers to call ChatGPT’s own signed-in APIs with the same access as the victim, reaching any chat the account could open.
The researchers reported the vulnerability through OpenAI’s bug bounty program. Parameter ran a controlled test between separate accounts rather than against real users, and does not report any real-world use of the flaw.
For small and mid-sized business owners whose employees paste client names, project details, or strategy notes into AI chat tools, the technical chain that made this attack work matters less than the business exposure it represents. A malicious link looks identical to a legitimate shared conversation. It arrives the same way: email, chat message, support ticket, social post. The victim does not install anything, join a workspace, or sign in through the attacker. In the most reliable version of the attack, they opened the link and clicked ChatGPT’s Preview button once. In a later version, Parameter set the page to open Preview on its own, so opening the link was the only step.
What AI security risks does this attack expose?
Once the link opened, attacker code ran inside the victim’s signed-in session with the same access as the real ChatGPT site. It listed the victim’s recent conversations, opened a private chat that had never been shared with the attacker, and sent a small portion of it to a server controlled by the researchers. The code called ChatGPT’s own signed-in APIs directly, rather than copying what happened to be on the screen.
Because it ran with the victim’s full web access, its reach was not limited to those chats. The researchers noted that essentially, they could perform any action on behalf of the victim’s ChatGPT account.
Suppose a project manager at a professional services firm receives a shared ChatGPT link from a trusted colleague. The link appears to contain research about a new software tool the team is evaluating. The manager opens it during a meeting. In the background, the malicious code accesses a private chat where the manager discussed client contract terms, budget ranges, and staffing constraints. That conversation was never shared publicly. It contained details the firm would not put in email. The attacker now has a copy.
The business consequence is not the technical method. It is the fact that employees use AI tools to think through problems they would never put in a spreadsheet or send in a message, and those tools now accept input from outside your organization in ways that look identical to safe, internal sharing.
How did the attacker break out of the sandbox?
ChatGPT can turn a block of HTML in a chat into a small web page through a feature called Preview. Because that page can hold any code, ChatGPT runs it in a locked-down frame on a separate web address, where it cannot read the main ChatGPT page around it. That sandbox held.
The way in came from a second feature in the same conversation. The shared chat also contained an interactive graph, and drawing it loaded a math library called MathLive into the main ChatGPT page. Loading MathLive left a listener running there that accepted messages about its on-screen keyboard.
A message passed between browser frames is safe only if the receiver checks who sent it. Parameter found that this listener accepted a keyboard message without verifying the sender. The attacker’s code inside the Preview frame sent that message, and the listener executed it on the main page. From there, the code had access to everything the logged-in session could reach.
The technical detail matters only because it shows how complex AI platforms introduce interaction paths that traditional web security models do not anticipate. A feature designed to display math notation became the route past a security boundary.
What should SMBs audit after this disclosure?
Start with inventory. Which AI tools do employees use? ChatGPT is one. Anthropic Claude, Google Gemini, Microsoft Copilot, and dozens of smaller platforms offer similar features. Do those platforms allow users to share conversations through public links? If yes, what access does a recipient have when they open that link?
Next, ask what employees put into those tools. Client names, project timelines, pricing, personnel issues, merger discussions, legal strategy, patient identifiers, student records, and financial forecasts all appear in AI chats because the tools make it easy to ask questions and refine ideas. If an attacker could read those chats, what regulatory obligation would you trigger? What client notification would you owe? What competitive advantage would you lose?
Then audit your acceptable use policy. Does it address AI tools? Does it prohibit pasting regulated data into unapproved platforms? Do employees know which platforms are approved? Do you have a contract with those vendors that defines data handling, breach notification, and liability? Do you log which employees use which tools, so you can scope an incident if a vendor discloses a breach?
Finally, consider whether your cyber insurance policy covers AI-related exposures. Many policies written before 2024 do not explicitly address generative AI tools. If an employee shares a malicious link internally and it spreads to client accounts, does your coverage respond? Ask your broker for a written answer.
How do you govern AI tool sharing in practice?
Policy without enforcement is theater. If your acceptable use policy prohibits sharing regulated data in AI tools but you do not monitor outbound traffic to ChatGPT, Claude, or Gemini, you have no way to know whether employees follow the rule.
Technical controls come first. Web filtering can block unapproved AI platforms entirely, or allow access but block file uploads and long-form text entry. Data loss prevention tools can scan clipboard content and block paste operations that contain patterns matching Social Security numbers, credit card numbers, or client identifiers. Endpoint detection tools can log which applications employees run and which websites they visit, giving you an audit trail when an incident occurs.
Contracts come second. If you allow employees to use ChatGPT, Gemini, or another platform, do you have a business account with a data processing agreement? Consumer accounts typically grant the vendor broad rights to use input for model training. Business accounts with negotiated terms can prohibit training on your data and require breach notification. The difference matters when you explain to a client or regulator what happened to their information.
Training comes third. Employees need to understand that a shared AI link is not the same as a shared document. A document sits in a defined location with access controls you set. A shared AI link is a URL that anyone can open, and the code behind it can do anything the platform allows. If the platform has a vulnerability, that link is an attack vector.
What does this mean for AI adoption timelines?
AI security risks do not mean you reject AI tools outright. They mean you evaluate them the same way you evaluate any software that handles business data. Does the vendor publish security advisories? Do they participate in bug bounty programs? Do they patch disclosed vulnerabilities quickly? Do they notify customers when a breach occurs?
Parameter reported this flaw through OpenAI’s bug bounty program. OpenAI patched it. That process worked. The risk is not that vulnerabilities exist. Software has vulnerabilities. The risk is that your employees use tools without knowing what access those tools grant, what data they store, and what happens when someone shares a link.
If your AI adoption timeline assumes employees will use these tools safely without governance, adjust that assumption. If your budget includes subscriptions but not data loss prevention, web filtering, or contract negotiation, adjust that budget. If your compliance program audits email and file shares but not AI chat logs, expand that program.
The opportunity AI offers is real. The productivity gain from summarizing documents, drafting responses, and generating code is measurable. The exposure is also real. A malicious link that reads private chats can access the same client data, the same strategy notes, and the same financial projections that would trigger a breach notification if stolen from email or a file server. Govern it the same way.
Keep reading
Sources
Source: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
Researched and drafted with AI, then reviewed and approved by Ron Trotto before publishing.