Parameter Labs, a security research team, said it found a way to take over a ChatGPT account through a shared link. The team said an attacker could publish a booby-trapped conversation using ChatGPT's normal share feature. When a signed-in user opened it, the attacker's code ran inside that user's session. Parameter said its test code listed the victim's chats, read a private one, and sent a small piece of it to an outside server. OpenAI fixed the flaw on October 26 and rated it P1, the team said.
Parameter said the attack chained features that looked safe alone. An HTML Preview, which runs code in a walled-off frame, sent messages to MathLive, a math library behind ChatGPT's graphs. MathLive did not check the sender and placed the supplied HTML into the main page. A YouTube script endpoint, which ChatGPT's security policy allowed, then let the code run. Simon Willison wrote that OpenAI paid a $5,000 bounty. Neither source says whether attackers used the flaw on real users.
Parameter said the flaw appeared only when several features worked together, not in any one of them. For teams that build software with shared pages or embedded frames, its advice is to check who sent every cross-frame message. It also says shared content should be treated as untrusted input.