What does Parameter do?

Parameter runs AI agents that test web applications, APIs and infrastructure for vulnerabilities on a continuous basis and report validated findings with a proof of concept.

What did Parameter find in ChatGPT?

Its researchers showed in October 2026 that a public ChatGPT share link could run JavaScript in the signed-in session of whoever opened it and read their private conversations. OpenAI fixed the issue on 26 October 2026, according to Parameter.

Parameter news

AI security company1 story

Parameter is a Y Combinator-backed security company that sells AI agents for continuous penetration testing of web apps, APIs, cloud setups and code.

A smartphone showing the ChatGPT web app in a browser lies on a dark laptop keyboard. — ChatGPT flaw let a single shared link take over accounts, Parameter researchers say

Cybersecurity31 Oct 2026, 14:05 UTC

Parameter says a public ChatGPT share link could run code in a victim's session and read private chats. OpenAI fixed the bug on 26 October and paid $5,000.

Summary

Security firm Parameter disclosed on 28 October 2026 a bug chain that let an attacker take over a ChatGPT web session by sending a public share link. A math keyboard component trusted messages from the sandboxed HTML Preview, which let researchers run JavaScript as chatgpt.com and read private chats. Parameter says OpenAI rated the report P1, fixed it on 26 October and paid a $5,000 bounty. OpenAI has not published its own statement.

About Parameter

Parameter is a Y Combinator-backed security company that sells AI agents for continuous penetration testing of web apps, APIs, cloud setups and code. Its Parameter Labs blog publishes research write-ups once the reported bugs are fixed, including an October 2026 chain that took over ChatGPT accounts through a public share link.

Reviewed 31 Oct 2026

Facts at a glance

Type: Autonomous AI penetration testing and continuous security
Products: Pentesting, cloud security, supply chain, Sentinel (pre-merge checks) and Watchtower (attack surface) source
Backing: Y Combinator, according to the company source
Co-founders: Huzaifa Ahmad, Ahmad Khan, Prama Yudhistira source
Notable research: ChatGPT account takeover via a public share link, reported 18 October 2026, fixed 26 October 2026, $5,000 bounty source

Questions people ask

What does Parameter do?: Parameter runs AI agents that test web applications, APIs and infrastructure for vulnerabilities on a continuous basis and report validated findings with a proof of concept.
What did Parameter find in ChatGPT?: Its researchers showed in October 2026 that a public ChatGPT share link could run JavaScript in the signed-in session of whoever opened it and read their private conversations. OpenAI fixed the issue on 26 October 2026, according to Parameter.

Parameter news

Every story about Parameter

ChatGPT flaw let a single shared link take over accounts, Parameter researchers say