ChatGPT provides a convenient feature that allows users to prefill a prompt directly via a URL using the q parameter — for example: chatgpt.com?q=[yourQuery]. Test it on desktop, by clicking on this link (safe): https://chatgpt.com/?q=How%20are%20you?

This is designed to enable helpful use cases, like embedding prompt links on a website or within documentation, where clicking the link automatically loads and runs a specific query for the user (just like the example above). However, this mechanism poses a significant security risk if abused. On the web (not mobile), the query executes immediately upon loading, which can be exploited through shortened URLs, QR codes or even just visible links.

An attacker could craft a malicious prompt that, once triggered, instructs ChatGPT to extract sensitive data (e.g., content from memory or conversation history) and exfiltrate it to an external API. If the user is authenticated and has memory enabled, this could result in private data being unknowingly leaked. This highlights the need for stricter input handling and execution control for prefetched queries, especially on the web platform by for example OpenAI.

For example, if a user visits a malicious website that contains a link to ChatGPT with such query, the query will execute immediately and the user's private data could be exposed. Disabling the q parameter is not possible, so you should be very careful when clicking on links redirecting you to ChatGPT, especially when you have memory enabled. This is because the query will execute immediately and the user's private data could be exposed.