A Single Shared Link Could Hijack Any ChatGPT Account, Researchers Find

A single ChatGPT share link was, until late October, enough to let an attacker take over another person's account. A security researcher only had to send the link by email, chat message or social post; the recipient needed only to open it, with no download, sign-in, or workspace invitation required. Once opened, attacker-controlled code could run inside the victim's own signed-in session, read their private conversations, and call ChatGPT's internal systems on their behalf.

The flaw was discovered by Parameter, a San Francisco-based security startup that builds AI agents to continuously penetration-test customer software, and reported to OpenAI through its bug bounty program, run on the Bugcrowd platform, on Oct. 18. OpenAI reproduced the issue, escalated it from an initial moderate rating to its most serious internal category, and confirmed a full fix across its web front end by Oct. 26, eight days after the report. The company paid Parameter a $5,000 bounty through its OpenAI-branded program on Bugcrowd, an amount independent developer and researcher Simon Willison called low for a vulnerability of this severity. Parameter published its own technical account of the find on Oct. 28, after the fix was confirmed, and The Hacker News and other outlets reported on it over the following days.

How a Math Equation Became an Account Takeover

The attack chain, as Parameter describes it, ran through two ordinary ChatGPT features used together. The attacker built a conversation containing an interactive graph, which loads a third-party math-rendering library called MathLive into ChatGPT's main page, and an "HTML Preview," a feature that renders a block of chat-generated HTML inside a sandboxed frame that is supposed to be isolated from the rest of the site. MathLive had installed a message listener on the main page to handle on-screen keyboard commands, but the listener did not check who was sending those messages, and it accepted raw HTML as part of them.

That gap let code running inside the sandboxed Preview frame pass attacker-written HTML into ChatGPT's trusted main page. That HTML, in turn, created a new, unrestricted frame that the browser treated as part of chatgpt.com itself. To get an actual script to execute inside that frame despite ChatGPT's content-security protections, which block most inline scripts, the researchers found that the policy made an exception for YouTube's embed service, whose response could be manipulated to return functioning JavaScript. From there, the injected code read the victim's session credentials directly from the page and called ChatGPT's own backend interfaces, the same ones the real site uses, to list and open private conversations the attacker had never been given access to. "Essentially, we could perform any action on behalf of the victim's ChatGPT account," the researchers wrote.

"Essentially, we could perform any action on behalf of the victim's ChatGPT account."

An AI Pentester Finds a Pattern in ChatGPT's Edges

Parameter, formed out of a company previously called Hex Security, markets itself on running continuous, automated penetration tests against customer applications rather than the periodic manual audits common in the industry; this particular find grew out of that broader effort to probe AI products for exactly this kind of cross-feature interaction. The vulnerability sat at the seam between two ChatGPT features that were each individually reviewed but had not been tested together: a math-rendering tool meant for a narrow purpose, and a general-purpose sandbox meant to let users preview web content safely. According to Parameter's writeup, the flaw was not a single coding error but three smaller design choices that combined — a listener that trusted messages regardless of sender, a willingness to treat that message's content as raw markup, and a browser frame that inherited more trust than it should have. The researchers' own stated lesson was that "isolation is only as strong as every bridge across it," and that the content-security policy blocking inline scripts should have been treated as a backup control rather than the primary line of defense.

ChatGPT's scale makes this kind of frontend bug consequential well beyond a typical web application. OpenAI has said ChatGPT has hundreds of millions of weekly users, many of whom route sensitive personal, financial, medical and professional information through the product and, increasingly, connect it to email, calendars and other accounts through its connector features. A flaw that lets an attacker act with a victim's full authenticated privileges, rather than merely view data on screen, in principle extends to any action the interface itself can take, not only the ones Parameter demonstrated in its limited proof. Parameter said its tests were run only between accounts and workspaces it controlled, exfiltrating a small, non-sensitive piece of test data to a server it owned, and that it found no evidence the bug had been exploited against real users before OpenAI's fix shipped.

What Happens Now

For ChatGPT's users, OpenAI's remediation required no action: the fix was applied entirely on the server side, with nothing to update, reinstall or reset on the user's end, according to Parameter's account of the disclosure. The episode is nonetheless likely to sharpen scrutiny of a now-familiar pattern in AI chatbot security, in which features designed to make a chat interface more capable — rendering interactive graphics, previewing generated web pages, connecting to outside accounts — expand the software's attack surface faster than its isolation mechanisms are tested to match. Security researchers have reported several previous ChatGPT sandbox and sharing-related issues over the past two years, most resolved quietly through the same bug bounty channel before reaching the public, a pattern that likely continues to shape how aggressively independent researchers probe OpenAI's newest features before and after they ship. OpenAI has not said publicly whether it is auditing other interactive features, such as its Canvas and connector tools, for similar cross-origin message-passing weaknesses, and did not respond, according to Parameter's published timeline, to a question about how long the vulnerable code had existed in production before it was found. Parameter, for its part, has used the disclosure to showcase its core pitch: that continuous, automated testing can surface exactly the kind of multi-step, cross-feature flaw that a one-time manual security review might miss.