Is ChatGPT Safe? How Three Small Bugs Could Expose Your Chats

Is ChatGPT safe? Mostly yes, but a researcher write-up published on October 28 shows how close it came to not being. Security researchers at Parameter say they chained three small web bugs in ChatGPT so that code they controlled could run inside a victim's signed-in session and read that person's private conversations. OpenAI fixed it on October 26, before the details went public.

There is no sign anyone used it against real users. The researchers' write-up describes a proof of concept they ran themselves, and it reports no in-the-wild exploitation. Still, it is a sharp answer to the question people keep typing into Google: is ChatGPT safe to use when you pour your work, health questions and half-finished ideas into it?

By the end of this piece you will understand how three harmless-looking flaws added up to account-level access, what was and was not exposed, what OpenAI changed, and a short checklist for opening and sharing ChatGPT links without worrying.

What happened: three ChatGPT bugs, one chain

Each of the three ChatGPT security issues looks minor on its own. According to the write-up, one lived in MathLive, a math editor component. One was about how that editor accepted data. One was about how an embedded frame on the page was set up.

Chained together, they let injected code run with "the same authenticated access as the normal frontend," in the researchers' words. In plain terms, the code could do what the ChatGPT website itself does on your behalf while you are logged in.

The researchers confirmed the full path on October 13 and reported it to OpenAI's bug bounty program on October 18. Ten days later, with the fix in place, they published the details.

How the attack worked, in plain English

Think of the ChatGPT page in your browser as an office building. Different parts of the page are rooms, and they pass notes to each other. The security of the building depends on every room checking who wrote a note before acting on it, and on visitors being kept in a lobby instead of wandering into the offices.

The chain broke both rules.

Flaw 1: a mailbox that accepted notes from anyone

Web pages can send each other messages. The safe pattern is to check where a message came from before doing anything with it. According to the researchers, MathLive's message listener accepted messages that changed its state without verifying the sender's origin or the window it came from. So a page the attacker controlled could send it instructions, and it would follow them.

Flaw 2: raw HTML hiding inside keyboard settings

The second problem was what those messages could carry. The write-up says the message format allowed raw HTML to be supplied as keyboard-layout data. A keyboard layout should be a boring list of keys. Accepting raw HTML there meant an attacker could slip in markup, and with it, code.

Flaw 3: a frame with no walls

Browsers let a page embed another document in an iframe, a box within the page. Developers can add a sandbox attribute that strips that box of powers, like keeping a visitor in the lobby. According to the researchers, one iframe was created without a sandbox attribute, so it inherited the chatgpt.com identity. That let the injected code reach the parent page, the real ChatGPT interface.

Put the three together and you get the chain: an unchecked mailbox, a payload smuggled in as keyboard data, and a frame that let the payload walk straight into the signed-in app.

Is ChatGPT safe for privacy? What an attacker could actually see

The biggest of the ChatGPT security concerns here is privacy. According to the write-up, the injected code could list up to 20 of the victim's recent conversations and pull out private conversation content the victim had never shared with anyone.

That matters because of what people put in chats. Drafts of contracts, code from work, symptoms they would not tell a coworker, salary numbers. A recent-chats list is a fairly complete picture of someone's week.

The researchers go further in one claim: they say the code could perform any action on the victim's account, because it ran with the same access as the website itself. But they are careful to say their proof of concept was limited to conversation data. So the demonstrated harm is reading chats. Anything beyond that is the researchers' assessment of what was possible, not something they showed.

It is also worth being clear about what the write-up does not say. It does not report that any real user was attacked, and the flaws sat in the ChatGPT web page itself. For another recent look at how attackers operate, see our piece on AI for hacking and the ARTEX campaign.

Is ChatGPT secure now? What OpenAI fixed and when

Yes, as far as this bug goes. The researchers' timeline, as published in their disclosure, runs like this:

Eight days from report to full fix is a reasonable turnaround, and the bump from P2 to P1 tells you OpenAI judged it more serious after reproducing it. The researchers say they were paid a $5,000 bounty in total.

So how secure is ChatGPT? No large web app is ever finished being secure. What this episode shows is a working process: an outside team found a real flaw, reported it to the bug bounty, OpenAI confirmed it within days, and the fix shipped before the public write-up. That is how responsible disclosure is supposed to work.

There is a fair critique, too. By the researchers' description, the missing pieces were ordinary web-security checks: an origin check, HTML filtering and a sandbox attribute. If you follow developer-tool security, our write-up on the Claude Code VS Code extension backdoor covers a different kind of risk.

Is ChatGPT safe to use? A short checklist

For most people the honest answer is the same as for email or cloud documents: safe enough for everyday work, as long as you treat it like an account that holds sensitive data. That is exactly what this bug showed it is.

How safe is ChatGPT for you specifically depends on what you put in it. A few habits cut the risk a lot:

• Be wary of unexpected links while signed in. According to the researchers, the attack ran in the victim's logged-in session. Opening odd links in a separate browser profile, or a window where you are not logged in to ChatGPT, limits what any similar bug could reach.
• Review your chat history. If a conversation holds something you would hate to see leaked, consider deleting it rather than keeping it forever.
• Think before pasting secrets. Passwords, API keys and client data are better kept out of any chat tool.
• Secure the account itself. A strong, unique password and multi-factor authentication are sensible protection for any account that holds private chats.

None of these would have been required to stay safe here, since the bug was fixed before it was public. They are the habits that make the next bug matter less.

How to share a ChatGPT conversation safely

To be clear, the researchers do not tie this bug to a ChatGPT share link or to ChatGPT shared links in general. Their chain ran through the math editor and an iframe, as described above. Still, the attack was built around a crafted link opened in a signed-in session, so link habits are worth a moment of thought:

• Check where a link goes. If someone sends you a link that claims to be a shared chat, confirm it points to chatgpt.com before you click while signed in.
• Strip private details before you share. Names, figures and internal notes do not belong in anything you pass along. Start a fresh chat with only what you want to show.
• Share with people, not the public web. Post a link only where you are comfortable with anyone who finds it opening it.

For the exact steps to share a conversation, use ChatGPT's own help pages, since the interface changes.

What to watch next

Three things are worth tracking. First, whether OpenAI publishes its own note on the bug; so far the researcher write-up is the only detailed account, so every claim here rests on it. Second, whether other apps that embed the same math editor find the same unchecked-message pattern. Third, whether the industry moves toward sandboxing every embedded frame by default.

So, is ChatGPT safe? Safer since October 26. The bug was real, the fix is in, and nobody is reported to have been hit. The lesson for users is simple: treat your chat history like your inbox, because to an attacker it is worth about the same.