A single shared ChatGPT link could take over your account. OpenAI has fixed it

The skim

• Security firm Parameter found that a booby-trapped ChatGPT share link could run the attacker's code inside the signed-in session of anyone who opened it, with access to their private chats.
• OpenAI rated it P1, its most serious category, fixed it on Oct. 26 and paid a $5,000 bounty. Parameter reports no real-world use.
• You don't need to do anything for this bug, but it's a good moment to lock down your account and treat shared links with care.

What happened

A single shared ChatGPT conversation was enough to take over someone else's account. That's the finding from Parameter, whose researchers built a public chatgpt.com/share link that, once opened, ran their JavaScript as chatgpt.com in the victim's logged-in browser. In their proof, the code listed the victim's recent conversations, pulled content from a private chat that had never been shared, and sent a piece of it to an outside server.

"Essentially, we could perform any action on behalf of the victim's ChatGPT account," the researchers wrote. In the most reliable version, the victim opened the link and clicked ChatGPT's Preview button once. In a later version, the Preview opened by itself, so opening the link was the only step.

How it worked

ChatGPT's Preview feature, which turns HTML in a chat into a small working webpage, runs inside a sandboxed frame on a separate web address. That sandbox held. The hole came from a second feature in the same conversation: an interactive graph that loaded a math library called MathLive into the main ChatGPT page.

MathLive installed a listener for messages about its on-screen keyboard, and it accepted those messages from any sender. Worse, the keyboard layout it accepted could contain raw HTML. So the sandboxed Preview could post a message, hand MathLive attacker HTML, and get it rendered on the real ChatGPT page as an unsandboxed frame. ChatGPT's content security policy blocked inline scripts but allowed scripts from YouTube, and a quirk in a YouTube endpoint let the researchers smuggle their code through that allowance. As The Hacker News puts it, the YouTube step was "only the final workaround, not the cause."

Why it matters

ChatGPT share links get passed around constantly in email, Slack, support tickets and social posts. This bug turned one into a credential-free account takeover, and for many people a ChatGPT history can include work documents, code and personal questions. It's also a reminder that sandboxes fail at their seams. Every feature here looked reasonable alone; the chain only existed when a graph, a Preview, a third-party library and a permissive script policy landed on one page.

The timeline was quick. Parameter reported the flaw on Oct. 18, OpenAI reproduced it on Oct. 21 and bumped it from P2 to P1, and both versions of ChatGPT's web frontend rejected the malicious messages by Oct. 26. Parameter published its writeup on Oct. 28. OpenAI paid $5,000 in total for the report.

What to do now

The fix is on OpenAI's side, so there's nothing to install or reset for this bug. Still, it's worth five minutes to turn on two-factor authentication in ChatGPT, check your security history and log out devices you don't recognize. And keep treating shared links like any other link: OpenAI says real conversation shares start with https://chatgpt.com/share/, and you should only open them from people you trust.

Sources: Parameter, The Hacker News and OpenAI Help Center.