Do the math: How we took over ChatGPT accounts parameter.ai

Parameter’s security research team says it exploited a flaw in ChatGPT’s shared conversations to run JavaScript in a victim’s signed-in session, read private conversation data and send it to an external server. The attack required opening a public share link; OpenAI fixed the issue on October 26, 2026, and awarded the researchers $5,000.