ChatGPT shared link flaw: do you need to do anything?

In short The flaw is fixed: there’s nothing to install and no need to reset your password. It’s still a good moment to clean up your own shared links.

What was the ChatGPT shared link flaw?

The Share button turns a ChatGPT chat into a link you can send to someone. Parameter found that an attacker could hide code (a small hidden program) inside such a shared chat. Anyone who opened the link while signed in on the ChatGPT website was at risk. In the version that worked best, the victim still had to click the Preview button once. In a later version, just opening the link was enough.

What could the code do? List your recent chats, open a private chat you had never shared and send part of it to the attacker. According to the researchers, the code could do almost anything you can do with your own account.
Was it abused? It was a controlled test between separate accounts, not against real users. Parameter reports no real-world abuse.
Timeline: reported to OpenAI on 18 October, fixed on 26 October and explained in a write-up by Parameter on 28 October.

Do you need to do anything after the ChatGPT flaw?

No, you don’t have to. The bug was on OpenAI’s side and was fixed there. A clean-up can’t hurt, though: anyone who has your shared link can read that chat and forward the link. According to OpenAI, you can’t set an expiry date for a shared link, and with a personal account you can’t limit it to specific people.

How to view and delete your shared ChatGPT links

Open chatgpt.com or the app and go to Settings.
Choose Data controls and, next to Shared links, click Manage.
Remove a link you no longer need with Delete shared link. Want them all gone at once? Choose More actions, then Delete all shared links.

Good to know: your chat itself stays, only the link disappears. Anyone who already saved the chat to their own account keeps that copy. And locking a chat with a PIN doesn’t delete an existing link.

Try it: share a ChatGPT chat safely

Still want to pass something on, like a recipe or travel plan? Let ChatGPT check it first. Type one of these at the bottom of the chat you want to share:

Check first: “Read through this chat and tell me which personal details are in it, like names, addresses, phone numbers or amounts. I want to remove them before I send anything.”
Text instead of a link: “Put the main tips from this chat into five short points, without any personal details. I’ll paste that text into a message.”

Simply copying and pasting the text is often safer than a link: you choose what the other person sees and no public link stays online.

Staying safe with ChatGPT links: 4 tips

Safety tip

A real shared chat starts with https://chatgpt.com/share/. Check that. But note: in this flaw, the dangerous link was also a genuine link like that. So only open shared links from people you know and trust.
Don’t put health information, bank details, passwords or account numbers in a chat you share.
Separately from this flaw: turn on two-step verification (a code on your phone on top of your password; in ChatGPT it’s called Multi-factor authentication) via Settings > Security and login. Worried someone else is in your account? Choose Log out of all devices there.
Got a suspicious message with a link? In Belgium, forward it to suspicious@safeonweb.be. In the Netherlands, report it to the Fraudehelpdesk.

Keep going with AI

New to AI? Request the free 2-day AI starter: two short sessions of about 15 minutes. No ChatGPT account yet? Follow our ChatGPT sign-up guide. Also read how to spot fake ChatGPT ads.

Sources

Checked on 2 November 2026. Features and prices change often: always check the official page. AI Op Zak is independent and not affiliated with the companies mentioned.