ChatGPT vulnerability: one shared link was enough to take over an account

On October 28, Mukul Goyal of Parameter published a write-up of a ChatGPT vulnerability that made it possible to take over an account through an ordinary public chat link (chatgpt.com/share/…). The attacker’s code ran inside the logged-in session of whoever opened the link. OpenAI closed the report on October 26 and paid out $5,000 through its bug bounty program.

How the ChatGPT vulnerability worked

The attack is a chain of four bugs (as the researchers describe it):

1. An interactive chart in a conversation loaded MathLive, an open-source library for typing math formulas. The library accepted cross-frame messages from any sender, without checking who sent them.
2. MathLive’s keyboard layout data could contain HTML, which the library inserted into the main page without sanitizing it.
3. That HTML created an iframe without a sandbox attribute, so the new document inherited the chatgpt.com origin.
4. ChatGPT’s Content Security Policy blocked inline scripts but allowed YouTube. YouTube’s oEmbed endpoint supported a JSONP-style callback, which let the researchers load their own code from an allowed domain.

In practice, the attacker published a normal-looking conversation. It started with a real chart (to load MathLive), followed by an HTML preview, i.e. the Preview feature that turns an HTML code block into a small working page. That preview is what sent the malicious messages to the library.

According to the researchers, opening the shared link was the only action required. In the most reliable version, the victim clicked Preview once. In a later one, the preview opened on its own, and proof of code execution appeared after about 4.5 seconds.

What exactly could the attacker do?

The code ran as chatgpt.com in the victim’s session, so it could call ChatGPT’s authenticated API on the victim’s behalf. In their proof of concept, the researchers fetched the list of recent conversations, then the contents of a private conversation nobody had shared with them, and sent a small piece of it to their own server.

According to the post, they could do practically anything on the victim’s account this way (“Essentially, we could perform any action on behalf of the victim’s ChatGPT account”). The attack also worked across separate accounts and workspaces.

How did OpenAI respond?

The timeline from Parameter’s post:

1. October 13: the researchers confirm the vulnerable MathLive path in production code.
2. October 18: they report it to OpenAI’s bug bounty program.
3. October 21: OpenAI reproduces the bug and raises its priority from P2 to P1.
4. October 22: a fix lands in one of the two web frontends, and on October 23 CSP changes block part of the chain.
5. October 26: both frontends reject the messages used in the attack, the report is closed, and the researchers get the bounty.

The post doesn’t mention the vulnerability being exploited in real attacks. It also doesn’t describe what exactly OpenAI changed in the code.

Why is everyone talking about it?

First, how simple the attack was. The link looked like any other shared ChatGPT chat, so checking the URL wouldn’t have helped.

Second, the bounty. The post hit the front page of Hacker News, and the amount is what keeps coming up in the comments: to many people, $5,000 for a one-link account takeover seems too little, and some worry that payouts this low will discourage researchers from reporting bugs.

Third, where the problem came from. Interestingly, the whole chain started with a library for typing math formulas (hence the post’s title, “Do the Math”). The more interactive extras a chat has – charts, page previews – the more places where something can go wrong. And shared conversations have caused trouble before: as we know, in the Meta Muse leak the titles of shared chats ended up in public DNS.

What to watch out for in the future

The researchers list two lessons for web app developers:

1. A receiver of cross-frame messages should check both the sender’s origin and the exact window it granted permissions to.
2. CSP should be a backup defense, not the only barrier once attacker HTML is already on the page.

For us as users, this vulnerability is already patched. Still, it’s worth remembering that a link to someone else’s chatbot conversation is still a link from a stranger. I write more about protecting accounts and API keys in my guide to AI agent security.

FAQ

Is the ChatGPT vulnerability fixed?

Yes. According to the researchers, OpenAI confirmed on October 26 that both ChatGPT web frontends reject the messages used in the attack.

Do I need to do anything with my account?

Parameter’s post doesn’t give any steps for users and doesn’t mention attacks beyond the researchers’ own tests.

How much did OpenAI pay for the report?

$5,000 through its bug bounty program. The report was given P1 priority.

Was opening the link really enough?

According to the researchers, yes. In one version of the attack, the victim still had to click Preview once; in a later one, the preview launched by itself.