The OpenAI logo. Image: OpenAI (logo, public domain via Wikimedia Commons)
A shared ChatGPT conversation, the kind people pass around every day, was until a few days ago enough to hand a stranger the keys to your account. Researchers at the security firm Parameter showed that opening a booby-trapped public share link ran their code inside the visitor’s signed-in ChatGPT session, where it listed the victim’s chats, read a private conversation and sent part of it to an outside server.
OpenAI fixed the flaw on October 26, eight days after Parameter reported it through OpenAI’s bug bounty programme. It rated the bug P1, its top severity, and paid a total of $5,000. Parameter published the details on October 28, and the write-up reached a wide audience this week.
What the attack could do
The victim didn’t need to install anything, join the attacker’s workspace or paste any code. In Parameter’s most reliable version, they opened the link and clicked ChatGPT’s normal Preview button once. In a later version the researchers made the preview open by itself, so opening the link “was the victim’s only click”. In their tests the code fired roughly 4.5 seconds after the page loaded.
Once running, that code was treated as chatgpt.com itself. It read the session token already sitting in the page and called ChatGPT’s own back-end APIs as the victim: first a list of their 20 most recent conversations, then the messages in a private chat that had never been shared with anyone. It then sent a small piece of that chat to a server Parameter controlled, using an ordinary image request.
The researchers deliberately sent out only a sample, but say nothing limited the code to that. “Essentially, we could perform any action on behalf of the victim’s ChatGPT account,” they wrote. Parameter doesn’t report any use of the flaw against real users; its proof ran between separate test accounts.
A maths keyboard opened the door
The attack stitched together features that each looked safe on their own. ChatGPT’s Preview turns a block of HTML in a chat into a working mini web page, and because that page can hold any code, ChatGPT runs it in a locked-down frame on a separate web address. That sandbox held: code inside it couldn’t read the ChatGPT page around it.
The weak point sat elsewhere on the page. When a conversation includes an interactive graph, ChatGPT loads an open-source maths library called MathLive, which sets up a listener for messages about its on-screen maths keyboard. Browsers let walled-off frames post messages to each other, so the receiver is meant to check who sent them. MathLive’s listener accepted keyboard messages from any web address, and the keyboard layout it accepted could contain raw HTML, which it dropped straight into the real ChatGPT page.
From there the researchers slipped in an embedded frame with no sandbox, which inherited chatgpt.com’s identity. ChatGPT’s content security policy blocked inline scripts but trusted YouTube, so they used a quirk in YouTube’s oEmbed endpoint, which echoed a callback name back as JavaScript even while rejecting it, to load and run their code. The last step was packing a real graph and a later HTML preview into one ordinary public conversation, so the whole trap survived being shared as a link.
Fixed in eight days
Parameter’s timeline says it confirmed the core bug against ChatGPT’s live code on October 13 and filed its report on October 18. OpenAI reproduced it on October 21 and raised the severity from P2 to P1. The fix rolled out across two versions of ChatGPT’s web front end, with security policy changes blocking part of the chain on October 23, and on October 26 OpenAI confirmed both versions rejected the MathLive messages and closed the report. OpenAI hasn’t commented publicly.
Parameter’s own lessons are blunt: anything that receives messages from another frame should check both the sender’s address and the exact window, settings passed between windows shouldn’t carry raw HTML, and a content security policy should be “a backup control, not the only barrier”.
It is the second ChatGPT privacy hole made public this month, after a flaw in ChatGPT’s Mac app let other programs on a computer read users’ chat logs. Shared AI chats have proved risky elsewhere too: a single search turned up 6,800 shared Meta Muse conversations, including a loan application and a CEO’s revenue review.
Why it matters
Shared links are among the most trusted things in ChatGPT, and until the fix opening the wrong one could have meant handing over everything in your account. The sandbox itself held; the leak came through a third-party library on the page around it, a reminder that AI apps which run code for you are only as safe as every part that touches it.
Sources: Parameter Labs, Do the Math: How We Took Over ChatGPT Accounts
Latest OpenAI news
