ChatGPT Share Link Flaw Exposed Private Chats

A malicious ChatGPT share link could take over a signed-in user's account and read private conversations, security firm Parameter said in a write-up published Oct. 28. The company reported the flaw to OpenAI's bug bounty program on Oct. 18, and OpenAI resolved it on Oct. 26, rating it P1 and paying a $5,000 bounty. The Hacker News reported the findings on Oct. 31.

Key takeaways

• Opening a crafted public share link was enough to run attacker code as chatgpt.com in the victim's session, according to Parameter.
• In a controlled test, the researchers listed a victim's conversations and read a private chat that had never been shared.
• OpenAI fixed both of its web frontends by Oct. 26. Parameter reported no exploitation outside its own tests, and The Hacker News says users need not take any action.

How the ChatGPT share link account takeover worked

Parameter researcher Mukul Goyal laid out the chain in a post titled "Do the Math: How We Took Over ChatGPT Accounts." It started with a public share containing an interactive graph. The graph loaded MathLive, an open-source math input library, which set up a message listener in the main ChatGPT page.

ChatGPT's HTML Preview runs untrusted code in an isolated frame on a separate origin. But that frame could still send messages to the main page, and MathLive's listener did not check where they came from. A message could swap the library's virtual keyboard layout for attacker-supplied HTML, which MathLive inserted without sanitizing it.

The injected markup created an iframe with no sandbox attribute, so it inherited the chatgpt.com identity. ChatGPT's content security policy blocked inline scripts but allowed YouTube, and the researchers used a YouTube oEmbed endpoint that reflected their text into a JavaScript response to supply the code.

"The victim did not need to install an App, join a Project, paste code, or open developer tools," Goyal wrote. "Opening the shared link was the only required action." In the most reliable version, the victim clicked Preview once. A later version opened Preview automatically.

What the attacker could see

Because the code ran as chatgpt.com, it could call ChatGPT's signed-in frontend APIs. In its proof, Parameter listed recent conversations, opened a private chat between separate test accounts and sent a small piece of it to its own server. The Hacker News quoted the researchers as saying they could "perform any action on behalf of the victim's ChatGPT account."

Timeline of the OpenAI bug bounty fix

Context: shared content as an attack surface

Parameter named three root causes: MathLive accepted a state-changing message without verifying the sender, the message format allowed raw HTML, and that HTML could create an unsandboxed document. It called the YouTube step a workaround, not the core bug. "CSP is valuable defense in depth, but it cannot make an unsafe rendering path safe," Goyal wrote.

MathLive had a separate cross-site scripting flaw this year. CVE-2026-54705, published July 29 and rated 6.3 (medium), let its \text{} and \mbox{} commands emit unescaped characters and was fixed in version 0.110.0. Parameter's chain used a different path.

What's next for developers

Parameter urges teams to check both event.origin and event.source before acting on postMessage instructions, avoid passing raw HTML through cross-window settings and keep dynamically created documents sandboxed. "Isolation is only as strong as every bridge across it," Goyal wrote.

FAQ

Do ChatGPT users need to do anything?

No. "The fix is on OpenAI's side, with nothing to install or reset," The Hacker News reported.

Was the flaw used in real attacks?

Parameter reported no exploitation outside its controlled tests and used separate accounts for its private-chat proof.

References

• Do the Math: How We Took Over ChatGPT Accounts — Parameter (Oct. 28, 2026)
• A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats — The Hacker News (Oct. 31, 2026)
• CVE-2026-54705: mathlive's Lack of Escaping of HTML allows for XSS — GitLab Advisory Database (July 29, 2026)