# A shared ChatGPT link could have handed over the account of anyone who opened it; OpenAI has fixed the flaw

> Parameter’s chain ran through the MathLive library and a YouTube endpoint that bypassed CSP. No exploitation is known, and users don’t need to do anything.

- Publisher: JARRUS (@jarrus.tech), thejarrus.com
- Story date: Oct. 28, 2026 (2026-10-28)
- Published: 2026-11-01
- Tags: OpenAI, Safety and security
- URL: https://thejarrus.com/en/news/chatgpt-share-link-flaw/

### Running code in a session through a link

In a post published Oct. 28 under researcher Mukul Goyal's byline, titled "Do the Math: How We Took Over ChatGPT Accounts," security firm Parameter described a way to turn an ordinary public ChatGPT share into attacker-controlled JavaScript running inside the signed-in session of whoever opened it. In the scenario, the attacker creates a malicious conversation, publishes it with ChatGPT's normal sharing feature and sends the link by email, chat, a support ticket or a social post. The person opening the link did not need to install an app, join a project or paste any code.

Parameter writes that it confirmed the code ran with chatgpt.com's identity and the victim's session privileges, and that it could list the victim's conversations, retrieve content from a private conversation never shared with the attacker and send a small selected value from it to an external server. Because the code could call ChatGPT's authenticated frontend APIs on the victim's behalf, the researchers say it could perform the actions available to the victim, meaning accounts **could have been taken over**. Parameter produced its proof between its own separate accounts.

### A five-step chain

The chain starts with two features that look harmless on their own: an interactive graph and an HTML Preview. ChatGPT runs HTML code blocks in a restricted frame on a different web address, and that isolation worked as intended by itself.

First, a graph in the same conversation loads a math library called MathLive, which installs a listener in the main ChatGPT page for messages about its on-screen keyboard. Second, the restricted Preview sends a cross-frame message (postMessage) to that listener. MathLive did not check which address or window the message came from, accepted raw HTML as keyboard-layout data and wrote that HTML into the main page when the keyboard opened. Third, the HTML creates a frame (iframe) without a sandbox attribute inside the main page; because the main page created it, the browser gives it the chatgpt.com identity. Fourth, the content security policy (CSP) is bypassed: ChatGPT's CSP blocked inline scripts but allowed scripts from YouTube. YouTube's oEmbed endpoint placed an invalid JSONP callback name at the start of its response before returning an error, which let the researchers run their own code through it. Fifth, the running code reads session information from the page and calls ChatGPT's APIs with the victim's session.

According to Parameter, three design decisions turned the mistake into a full exploit: MathLive accepted a state-changing message without verifying the sender, the message format allowed raw HTML as keyboard-layout data, and that HTML could create an unsandboxed document inheriting the chatgpt.com identity. The YouTube response was not the root cause but the final workaround for CSP.

The first working version required a ChatGPT App controlled by the researchers. Putting the graph and the Preview in the same public conversation made the chain portable through a single share link. In the most stable version, the victim had to open the share and click ChatGPT's normal Preview button once. When the HTML block was set to preview automatically, opening the link was enough; Parameter says it reproduced that automatic path three times in a separate account, with the code running after roughly 4.5 seconds.

### Timeline and fix

Parameter confirmed the first link of the chain against ChatGPT's production code on Oct. 13, saw it work through a share link between separate accounts on Oct. 16 and with automatic Preview on Oct. 17. It reported the flaw to OpenAI's bug bounty program on Oct. 18 and added the private-chat disclosure proof on Oct. 19. OpenAI reproduced the issue on Oct. 21 and raised its severity from the initial P2 triage to **P1**. The fix rolled out separately across two versions of ChatGPT's web frontend: one was fixed on Oct. 22, CSP changes blocked part of the chain on Oct. 23, and on Oct. 26 OpenAI confirmed both versions rejected the MathLive messages and closed the issue. The researchers received a total bounty of **$5,000**.

According to The Hacker News, writing on Oct. 31, there is no report of the flaw being used in real attacks. Because the fix was made on the server side, users don't need to do anything. Beyond the fix and the bounty, there is no direct statement from OpenAI on the matter.

Parameter's lessons are that cross-frame message receivers should verify both the sender's address and its window, cross-window settings should not carry raw HTML, documents that an untrusted frame can influence should stay sandboxed, and CSP should be treated as a backup control rather than the only barrier.

## Sources

1. [Parameter: Do the Math: How We Took Over ChatGPT Accounts, Oct. 28, 2026](https://www.parameter.ai/labs/we-found-a-gap-at-openai)
2. [The Hacker News: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats, Oct. 31, 2026](https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html)

Report an error: corrections@thejarrus.com