A single ChatGPT share link could take over your account

Parameter Labs, with researcher Mukul Goyal, found a chain that turned an ordinary ChatGPT share link into full account takeover. The victim only had to open the link while signed in. From there, attacker-controlled JavaScript ran with the identity of chatgpt.com and could read private conversations and call any backend API the web app exposes.

The clever part is that no single feature was broken. The attacker put a real interactive graph and an HTML Preview into one conversation, then shared it. The graph loads the MathLive library, which installs a postMessage listener on the main page for its virtual keyboard. The sandboxed Preview frame sends that listener crafted messages, and MathLive accepted them from any origin without checking the sender, then passed the attacker's HTML straight into innerHTML. That injected an iframe with no sandbox attribute, so it inherited the chatgpt.com origin. The last barrier was the Content Security Policy, which blocked inline scripts but allowed YouTube, so the researchers abused a YouTube oEmbed endpoint that reflected a callback parameter back as executable code. The proof listed the victim's 20 most recent chats, pulled the contents of a private conversation that was never shared, and sent a value to an outside server through a plain image request. In the automatic version the alert fired about 4.5 seconds after the page loaded.

The timeline is tight: confirmed in production code on October 13, reported on the 18th, raised to P1 on the 21st, and fully fixed by the 26th across two frontend versions. OpenAI paid a $5,000 bounty, which Simon Willison called cheap for a bug this serious.

Why it matters

If you build anything that renders untrusted content in a sandboxed frame, this is the failure mode to study: the sandbox held, but a trusted component in the parent page accepted its messages without checking event.origin and event.source. Audit every postMessage receiver that can change state, and stop treating CSP as a safety net for an unsafe rendering path.