A malicious ChatGPT share link could run an attacker's code inside the logged-in session of anyone who opened it, and that code could read private conversations, call the platform's APIs directly, and essentially do anything on behalf of the victim's account.
The security firm Parameter discovered the flaw, reported it through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later, rating it P1, the company's most serious category. If you used ChatGPT during that window, the fix is already live, but the technical details of how the chain worked are worth understanding.
The Trap Was Just a Shared Chat
Here is the scariest part: the attack did not require malware, a fake login page, or a rogue workspace invite. The trap was an ordinary ChatGPT conversation shared via its public link.
It could be sent the same way as any real shared chat, by email, as a chat message, as a support ticket, or as a social post. The victim did not have to install anything, join a workspace, or sign in through the attacker.
In the most reliable version of the attack, they opened the link and clicked ChatGPT's Preview button once. In a later version, Parameter set the page to open Preview on its own, so opening the link was the only step required.
What the Attacker Could Actually Do
Once the link opened, the attacker's code ran inside the victim's signed-in session with the same access as the real ChatGPT site. The code listed the victim's recent conversations, opened a private chat that had never been shared with the attacker, and sent a small portion of it to a server controlled by the researchers.
Because the code called ChatGPT's own signed-in APIs directly, rather than copying what happened to be on the screen, its reach was not limited to those chats.
"Essentially, we could perform any action on behalf of the victim's ChatGPT account," the researchers wrote.
This was a controlled test. Parameter does not report any real-world use of the flaw, and ran its private-chat proof between separate accounts rather than against real users.
The Sandbox Escape, Step by Step
ChatGPT can turn a block of HTML in a chat into a small web page through a feature called Preview. Because that page can hold any code, ChatGPT runs it in a locked-down frame on a separate web address, where it cannot read the main ChatGPT page around it.
That sandbox held. The way in came from a second feature in the same conversation.
|
Attack Stage |
What Happened |
Why It Worked |
|
1. Interactive graph |
A shared chat contained an interactive graph |
Drawing it loaded MathLive into the main ChatGPT page |
|
2. MathLive listener |
The library left a listener running for its on-screen keyboard |
The listener accepted messages from any sender |
|
3. Raw HTML in message |
The message was allowed to carry raw HTML as keyboard-layout data |
MathLive did not check which frame had sent the message |
|
4. Unsandboxed frame |
The HTML built a new frame treated as part of chatgpt.com |
The frame was not sandboxed and inherited the domain identity |
|
5. YouTube script |
A script loaded from YouTube supplied the code |
ChatGPT's CSP allowed YouTube but blocked inline code |
The researchers traced the problem to three design choices that lined up. MathLive acted on a message that changed its settings without checking which frame had sent it. That message was allowed to carry raw HTML as keyboard-layout data. And the HTML could create a frame that was not sandboxed and inherited the chatgpt.com identity.
The YouTube step was only the final workaround, not the cause. Blocking it alone would still leave an untrusted Preview able to push HTML into the main site.
What OpenAI Fixed, and What Users Should Do
Parameter said OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1, and rolled a fix across two versions of ChatGPT's web frontend.
By October 26, both versions rejected the messages the attack relied on.
ChatGPT users do not need to do anything. The fix is on OpenAI's side, with nothing to install or reset. OpenAI paid a total of $5,000 for the report, and Parameter published its writeup on October 28, after the fix.
FAQ
What is the ChatGPT share link vulnerability?
It is a flaw in ChatGPT's Preview feature that let a malicious shared chat run the attacker's code inside the victim's logged-in session. The code could read private conversations and call ChatGPT's APIs on the victim's behalf.
Did the attacker need to trick me into installing anything?
No. The victim did not have to install anything, join a workspace, or sign in through the attacker. In the most reliable version, they opened a shared chat link and clicked Preview once.
Is my ChatGPT account still vulnerable?
No. OpenAI fixed the flaw on October 26, and both versions of its web frontend now reject the messages the attack relied on. Users do not need to do anything.
How did the sandbox escape actually work?
The attacker chained three design choices. A math library called MathLive accepted messages from any sender, those messages could carry raw HTML, and the HTML could create an unsandboxed frame that inherited the chatgpt.com identity.
Why did OpenAI rate this P1?
P1 is OpenAI's most serious bug bounty category. The flaw allowed full account takeover of the victim's ChatGPT session, including access to private conversations and the ability to perform any action on their behalf.
