We Took over ChatGPT Accounts

Security researchers at Parameter Labs found that an ordinary public ChatGPT share link could run their own code inside the signed-in session of whoever opened it. Their write-up reports that they used this to list a victim's recent conversations, read a private conversation that had never been shared with them, and send part of it to a server they controlled. The victim did not need to install anything or paste code. Opening the link, and in some versions clicking ChatGPT's normal Preview button once, was enough. The researchers say the code could do anything the victim could do in the ChatGPT web app. OpenAI raised the report's severity from P2 to P1 after reproducing it, fixed it on October 26, and paid a $5,000 bounty.

The interesting part is that the obvious defense worked. ChatGPT's Preview feature turns an HTML code block into a small working webpage, and because that page can contain any code, ChatGPT runs it in a restricted frame on a different web address. The browser treats that frame as a separate website, so it cannot read the ChatGPT page around it. The researchers confirmed this isolation held.

The gap came from a second feature in the same conversation. An interactive graph loaded MathLive, a library for typing math, which set up a receiver in the main ChatGPT page for messages about its on-screen keyboard. Frames on different websites are allowed to pass each other messages, and that is safe only if the receiver checks who sent them. According to the article, MathLive accepted keyboard-layout messages from any sender and let the layout contain raw HTML. So the sandboxed Preview could not enter the main page, but it could tell a trusted library inside the page to build content for it. That content included a new embedded frame without sandbox restrictions, which the browser treated as part of chatgpt.com. ChatGPT's Content Security Policy, the rule list for which scripts a page may load, blocked the obvious ways to run code there but allowed scripts from YouTube, and the researchers found a YouTube response they could shape into running code.

The researchers call the YouTube trick a final workaround rather than the root cause, and the case supports that reading. Blocking that one script source would have left an untrusted frame able to write HTML into ChatGPT. The fixes OpenAI confirmed made both versions of its web frontend reject the cross-frame keyboard messages, which closes the gap where it started. Each feature looked reasonable on its own. The vulnerability existed only because a public share could hold a graph and a Preview side by side, so the boundary has to be checked across the whole page, not one feature at a time.