ChatGPT flaw let a single shared link take over accounts, Parameter researchers say

What Parameter found

Parameter, a security company that sells AI penetration testing agents, published a write-up on 28 October 2026 describing how its research team took over ChatGPT accounts with a single link. An attacker could build a conversation, publish it with ChatGPT's normal sharing feature and send the share URL to anyone. When the victim opened it while signed in, attacker-controlled JavaScript ran on chatgpt.com with the victim's session.

Parameter says its proof listed the victim's recent conversations, fetched a private conversation that was never shared with the attacker and sent part of it to a server the researchers controlled. Because the code ran with the web app's own authenticated access, the researchers write that it could in principle perform any action the ChatGPT frontend allows. In the most reliable version the victim clicked the Preview button once; in a second version the HTML block was marked to preview automatically, so opening the link was enough. Parameter reports reproducing that path three times from a separate account.

How the chain worked

ChatGPT's Preview feature runs HTML from a code block inside a restricted frame on a different web address, so it cannot read the main page. That isolation held, Parameter says. The gap came from a second feature: an interactive graph loads the open-source MathLive library, which installs a listener on the main ChatGPT page for messages about its on-screen keyboard. MathLive accepted those messages from any origin, and one message type let the sender replace the keyboard layout with raw HTML.

The Preview frame sent that message, and MathLive wrote the HTML into the real ChatGPT page. The researchers used it to create an unsandboxed iframe that inherited the chatgpt.com identity. ChatGPT's content security policy blocked inline scripts but allowed scripts from YouTube, so they loaded a YouTube oEmbed URL whose callback parameter was echoed back as JavaScript. Parameter stresses that the YouTube endpoint was a workaround, not the root cause: a privileged listener trusted messages without checking which window sent them.

What OpenAI fixed

According to Parameter's timeline, the team submitted the report to OpenAI's bug bounty program on 18 October. OpenAI reproduced both the code execution and the private chat proof on 21 October and raised the severity from P2 to P1. The fix covered two versions of the ChatGPT web frontend; content security policy changes blocked part of the chain on 23 October, and on 26 October OpenAI confirmed that both versions rejected the cross-frame MathLive messages, closed the report and awarded $5,000.

All of these dates come from the researchers. OpenAI has not published an advisory or a public statement about the issue, and Parameter does not say whether anyone used the chain before it was closed. The write-up recommends that message receivers check both the sender's origin and the exact window, that settings passed between frames never carry raw HTML, and that content security policy be treated as a backup rather than the only barrier.

Why it matters

AI assistants keep adding features that run code, render previews and load third-party libraries, and this chain lived in the seams between five of them. It follows other bugs where AI products exposed one user's data to another, such as the Cloudflare Workers AI cache exposure disclosed this month. More stories on flaws in AI tools are on the Cybersecurity hub.

Questions people ask

Do ChatGPT users need to do anything?

Parameter says OpenAI fixed the issue on the server side on 26 October 2026, so no user action is described. OpenAI has not published guidance of its own.

Was the ChatGPT share link flaw exploited?

Not stated. Parameter describes only its own controlled proof, and OpenAI has not said whether it saw any abuse.

How much did OpenAI pay for the report?

Parameter says OpenAI awarded a total bounty of $5,000 after raising the severity to P1.

Sources

1. Do the Math: How We Took Over ChatGPT Accounts (Parameter, 28 Oct 2026)
2. About Parameter (Parameter, 31 Oct 2026)