Researchers at Parameter showed that a malicious ChatGPT share link could run attacker code inside your signed-in session and read your private conversations.
How it worked
The trap was an ordinary-looking shared chat. In the best version you just opened it and the Preview feature ran on its own. Preview’s sandbox held, but the same chat drew an interactive graph using the MathLive library in the main page. MathLive accepted a settings message without checking which frame sent it, the message could carry raw HTML, and that HTML could create an unsandboxed frame with chatgpt.com’s identity. ChatGPT’s content security policy allowed scripts from YouTube, which delivered the final payload. From there the code could call ChatGPT’s own APIs as you.
It was reported October 18. OpenAI rated it P1, its top severity, fixed it by October 26 and paid $5,000. There’s no sign of real-world use, and you don’t need to do anything.
My take
A clean, honest disclosure with a fast fix. The bigger lesson is for anyone building AI apps: once your chatbot renders HTML and widgets, it’s a browser, with all of a browser’s attack surface. Check where every postMessage came from.
God Bless, and Happy hacking!
