Critical ChatGPT Flaw Allowed Attackers to Hijack Accounts and Steal Private Conversations With One Link

A critical ChatGPT flaw that let a malicious shared conversation run attacker-controlled JavaScript in another user’s signed-in session. The attack could list private chats, read conversations never shared with the attacker, and send stolen data to an outside server. Opening one crafted link was enough in the final demonstration.

OpenAI fixed the issue on October 26, 2026, according to Parameter’s technical disclosure, published by Mukul Goyal on October 28. The company classified the report as P1 and awarded a $5,000 bounty. The demonstrated account access came through the victim’s active browser session, rather than a stolen password.

The exploit combined an interactive graph with ChatGPT’s HTML Preview feature. Preview normally runs code inside a restricted frame on a separate web address, preventing it from directly reading the main ChatGPT page. That boundary initially worked as intended.

ChatGPT Flaw Exploited With One Link

The graph, however, loaded MathLive, a math library that added a message listener to the main page for its virtual keyboard. Through the browser’s postMessage interface, the isolated Preview could send instructions to that listener. MathLive accepted keyboard changes without properly checking the sender’s origin or requiring an approved source window.

One message supplied a keyboard layout containing attacker-controlled HTML. Another opened the keyboard, placing that HTML into the real ChatGPT page through innerHTML. A helper called createHTML passed the content through without removing unsafe markup.

This differs from the previously reported ChatGPT sandbox flaw that exposed Gmail data, which used shared internal storage. Here, the escape crossed a browser boundary through messages trusted by a privileged page component.

HTML injection alone did not immediately execute JavaScript. The researchers inserted an iframe using srcdoc, which stores an embedded page’s HTML directly in an attribute. Because this new frame lacked sandbox restrictions, it inherited ChatGPT’s web origin and could access the parent page.

ChatGPT’s Content Security Policy blocked inline scripts but allowed scripts from YouTube. The researchers found that YouTube’s oEmbed endpoint returned an attacker-supplied JSONP callback as JavaScript, even when reporting an invalid callback. Loading that response provided the final step needed to run code as chatgpt.com.

The researchers then placed both the graph and HTML Preview inside a public conversation. An earlier version required clicking Preview. The final version opened it automatically and was reproduced three times in a separate account, with execution appearing after roughly 4.5 seconds.

Private Chat Theft and OpenAI’s Fix

The payload read session details already available to ChatGPT’s frontend and called authenticated conversation APIs. It retrieved a private conversation unrelated to the shared link, then sent a small selected value to a research server through an image request.

Unlike the separately reported ChatGPT GitHub connector flaw, this attack did not depend on repository instructions or connected tools. Its access came directly from JavaScript running within the trusted website.

Parameter submitted the report on October 18. OpenAI reproduced the issue and raised its priority on October 21. By October 26, both affected web frontend versions rejected the reported MathLive messages. The case highlights why cross-frame receivers must verify both sender origin and source window, while untrusted HTML must remain sandboxed throughout rendering.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.