A critical security flaw in **OpenAI**'s **ChatGPT** could have allowed attackers to compromise user sessions and access private data simply by enticing victims to click a specially crafted share link. Researchers at the security firm **Parameter** uncovered the vulnerability, demonstrating how an attacker's code could run within a logged-in user's session, granting access to their conversations and potentially other account actions. ### The Malicious Shared Link Vector The attack leveraged an ordinary **ChatGPT** conversation shared via its public link. This link could be distributed through common channels such as email, chat messages, support tickets, or social media posts. Crucially, victims did not need to install software, join a workspace, or authenticate through the attacker's system. In its most reliable form, the attack required the victim to open the link and click **ChatGPT**'s 'Preview' button once. **Parameter** later refined the exploit to automatically trigger the 'Preview' upon opening the link, reducing the interaction to a single click. ### Scope of the Compromise Once activated, the attacker's code executed within the victim's signed-in **ChatGPT** session, inheriting the same privileges as the legitimate site. **Parameter**'s proof-of-concept demonstrated the ability to list recent conversations, open private chats that had never been shared, and exfiltrate portions of these conversations to a researcher-controlled server. The code directly called **ChatGPT**'s signed-in APIs, rather than merely scraping on-screen content. "Essentially, we could perform any action on behalf of the victim's **ChatGPT** account," the researchers stated, highlighting the broad impact of the vulnerability. **Parameter** confirmed that this was a controlled test, with no evidence of real-world exploitation. Their private-chat proof was conducted between separate, controlled accounts. ### How the Sandbox Was Breached  **Parameter** detailed the intricate chain of events that bypassed **ChatGPT**'s security measures. **ChatGPT**'s 'Preview' feature allows rendering HTML blocks into small web pages, which are typically confined to a sandboxed iframe on a separate web address to prevent interaction with the main **ChatGPT** page. While this sandbox remained intact, a weakness emerged from another feature within the same conversation: an interactive graph. Drawing this graph loaded the **MathLive** math library into the main **ChatGPT** page. **MathLive**, upon loading, left a listener running that accepted messages related to its on-screen keyboard. The critical flaw was that this listener failed to verify the sender of messages, accepting input from any frame. Furthermore, the message was permitted to carry raw HTML. This allowed the sandboxed 'Preview' frame to pass attacker-controlled HTML to the trusted main page. This HTML then constructed a new iframe that the browser treated as part of `chatgpt.com`. A script loaded from **YouTube** then supplied the final payload code that executed within this new frame.  **ChatGPT**'s Content Security Policy (CSP) restricts script sources, blocking inline code but allowing scripts from **YouTube**, which facilitated the final stage of the attack. ### The Fix and User Action **Parameter** reported the flaw to **OpenAI**'s bug bounty program on October 18. **OpenAI** promptly reproduced the code execution and private-chat proof, escalating the severity from P2 to P1. Within eight days, by October 26, **OpenAI** deployed a fix across two versions of **ChatGPT**'s web frontend, which now reject the malicious messages central to the attack. The researchers identified three core design choices that collectively enabled the exploit: 1. **MathLive** processed messages that altered its settings without validating the sending frame. 2. The message format allowed raw HTML to be embedded as keyboard-layout data. 3. The injected HTML could create an unsandboxed frame inheriting the `chatgpt.com` origin. The **YouTube** script loading was merely a final workaround, not the root cause. Blocking it alone would not have prevented an untrusted 'Preview' from injecting HTML into the main site. **ChatGPT** users are not required to take any action; the fix was implemented on **OpenAI**'s server side. **Parameter** published their findings on October 28, after the vulnerability had been patched, and received a $5,000 bounty for their responsible disclosure.