OpenAI Patches P1 ChatGPT Shared-Link Session Attack

OpenAI has fixed a critical ChatGPT web vulnerability that could have let a malicious public conversation link execute attacker-controlled code within a logged-in visitor’s session. Security firm Parameter reported the issue through OpenAI’s bug bounty programme on October 18; OpenAI classified it as P1, its most serious category, and completed the fix eight days later.

The researchers demonstrated that code running in a victim’s signed-in browser session could enumerate recent conversations, open a private conversation that had not been shared with the attacker, and transmit a small portion of it to a server controlled by the researchers. Parameter said its proof of concept used separate accounts and reported no real-world exploitation.

A public chat link became a session-level risk

The attack began with an ordinary ChatGPT shared-conversation URL, which could be distributed by email, messaging apps, support tickets or social posts. In the most reliable version, a recipient opened the link and selected ChatGPT’s Preview control. Parameter later configured the page to open Preview automatically, reducing the required interaction to opening the link.

ChatGPT’s Preview feature can render HTML from a chat as a small web page. That content runs in a sandboxed frame on a separate web address, designed to prevent it from reading the main ChatGPT page. Parameter found that the sandbox itself held; the escape depended on interaction with a second feature embedded in the same shared conversation.

Unchecked messages bridged the sandbox boundary

The malicious conversation also contained an interactive graph. Rendering that graph loaded the MathLive library into ChatGPT’s main page, where it retained a listener for messages related to its on-screen keyboard. Parameter found that the listener accepted a message from any sender and allowed raw HTML in keyboard-layout data.

The sandboxed Preview could use that path to pass attacker-controlled HTML to the trusted ChatGPT page. The HTML created a new frame that the browser treated as part of chatgpt.com. A script hosted on YouTube then supplied code that executed in that frame. ChatGPT’s content security policy blocked inline scripts but permitted scripts from YouTube, making that delivery step possible.

Parameter said the underlying chain involved three aligned conditions: MathLive did not validate the sending frame, its accepted message could include raw HTML, and that HTML could create an unsandboxed frame inheriting the chatgpt.com identity. The YouTube script was a workaround for the policy restriction rather than the underlying flaw.

Fix deployed on the web frontend

OpenAI reproduced both the code-execution and private-chat demonstrations, raised the finding from P2 to P1, and deployed changes across two versions of the ChatGPT web frontend. By October 26, both versions rejected the messages used by the attack. Parameter published its technical account on October 28 and received a total bounty of $5,000.

ChatGPT users do not need to install an update or reset their accounts because the remediation is server-side. For businesses, the incident is a reminder that sandboxing alone is insufficient when embedded components exchange browser messages: teams should verify message origins, constrain accepted data formats, and review whether untrusted content can create trusted-context frames.