Security firm Parameter said a shared ChatGPT link could run an attacker's code inside the signed-in session of anyone who opened it. In its test, the code listed a victim's recent chats, read a private chat never shared with the attacker, and sent a small part of it to a server the researchers controlled. OpenAI fixed the flaw on October 26 and rated it P1, Parameter said.
Parameter said the attack combined several features. A graph in the shared chat loaded MathLive, a math library, which accepted keyboard messages from any sender. An HTML Preview in the same chat sent it web code. A YouTube script, allowed by ChatGPT's security rules, then ran that code. The Hacker News reported that Parameter described no real-world use and ran its test between separate accounts. It also reported that Parameter filed the flaw on October 18 and that OpenAI paid $5,000.
Parameter said the code ran with the victim's full web access, so it could act on the account, not just show a pop-up. The Hacker News said ChatGPT users need to do nothing. For teams that build sharing, previews or third-party libraries, Parameter's lesson is to check who sent every message passed between frames.