Problem Solutions
A Shared ChatGPT Link Could Take Over Your Account — Fixed October 26, but the Lesson Stands
A public shared ChatGPT conversation could once take over the account of anyone who opened it — no password, no install, no pasted code. Security firm Parameter Labs published the full chain on October 28, after OpenAI fixed it on October 26 and paid a $5,000 bug bounty. The fix is server-side, so users have nothing to install. The story still matters, because it shows what a share link can carry: not just text, but executable content running as you.
The chain, step by step
The attack combined two ordinary features of the same conversation. First, an interactive graph in the conversation loads MathLive, the math-typesetting library, into the main chatgpt.com page. MathLive installs a postMessage listener for its on-screen keyboard, and that listener used an origin policy of “none”: it accepted messages from any sender, and it rendered the keyboard-layout field as HTML via innerHTML instead of sanitising it.
Second, an assistant-authored HTML Preview runs in a sandboxed iframe on a separate origin. That sandbox held — code inside a Preview could not touch the parent page, and Parameter is explicit that this boundary worked. But the Preview could send crafted postMessages to the MathLive listener, and the injected markup created a new iframe with a srcdoc attribute and no sandbox attribute, which inherited the chatgpt.com identity.
One barrier remained: ChatGPT’s Content Security Policy blocked inline scripts, but it allowed youtube.com, and YouTube’s oEmbed endpoint reflected attacker JavaScript back in a JSONP-style callback response. That was the final step to full script execution on the chatgpt.com origin.
What the proof showed
In the proof of concept, the injected code listed the victim’s conversations, read a private conversation that had never been shared, using ChatGPT’s own authenticated API, and exfiltrated a snippet to an external server. In the most stable version the victim had to click Preview once; in a later version opening the link was the only step, firing in about 4.5 seconds, reproduced three times including after a hard refresh. The victim did not need to install an app, join a project, paste code or open developer tools.
One honest caveat. What was demonstrated was reading chat data. The broader claim — that the attacker could perform any action on behalf of the account — follows from where the code ran, not from a separate demonstration of every action. That distinction matters, and it does not make the finding small: reading someone’s private chats is already a full compromise of what most people keep in ChatGPT.
The timeline
Parameter confirmed the path in production on October 13, built cross-account share delivery by October 16, and submitted the report through the bug bounty on October 18, adding the private-conversation proof the next day. OpenAI reproduced it on October 21 and raised the severity from P2 to P1, shipped a frontend fix on October 22, tightened the Content Security Policy on October 23, and confirmed both web frontends fixed on October 26 — eight days from report to fix. MathLive 0.111.2, released October 31, changed its default to same-origin validation, closing the vector for every app embedding the library, not just ChatGPT; its changelog does not mention ChatGPT, and no CVE was assigned.
There is no evidence of real-world exploitation, and OpenAI has published no advisory of its own — the fix is documented only in the researcher’s timeline. That silence is itself part of the lesson: the most serious account-takeover path in ChatGPT’s recent history surfaced through a researcher’s blog post, not through the vendor.
What to do
Nothing needs installing, and opening a crafted share today does not run the payload. But treat public share links like attachments from strangers from now on. Real shares start with https://chatgpt.com/share/, and you should only open shares from people you trust. If you opened a share from an untrusted source before October 26, the fix has closed the window, but it costs nothing to skim your recent chats for anything unfamiliar — and to remember that a conversation you were sent can contain more than words.