ChatGPT share links allowed code execution in user sessions

Security researchers at Parameter discovered a critical vulnerability in ChatGPT that allowed malicious code to execute within a victim’s logged-in session via a shared conversation link. The flaw, reported on October 18, 2026, enabled attackers to access private chats and perform actions on behalf of the user. OpenAI classified the issue as P1 severity and deployed a fix by October 26.

What happened

The attack vector relied on the standard ChatGPT feature that allows users to share conversations via public links. An attacker could craft a specific conversation containing malicious elements and share it through email, social media, or support tickets. When a victim opened this link, they did not need to install software or log in again; the exploit targeted their existing authenticated session. In the initial proof of concept, the victim needed to click the Preview button once. A refined version automated this step, requiring only that the victim open the link.

Once triggered, the attacker’s code ran with the same privileges as the legitimate ChatGPT interface. This allowed the malicious script to call signed-in APIs directly, listing recent conversations and opening private chats that had never been shared. The researchers demonstrated that they could exfiltrate portions of these private discussions to an external server. Because the code operated within the victim’s full web access context, its capabilities extended beyond just reading chat history to performing any action the account holder could perform.

Parameter conducted this work as a controlled test between separate accounts and reported no evidence of real-world exploitation. They submitted their findings through OpenAI’s bug bounty program. OpenAI initially rated the severity as P2 but upgraded it to P1 after reproducing the exploit. The company paid a total of $5,000 for the report and rolled out fixes across two versions of its web frontend.

How it works

The vulnerability emerged from an interaction between three distinct features: the Preview sandbox, the MathLive library, and cross-frame messaging. ChatGPT uses a sandboxed frame on a separate domain to render HTML previews, preventing them from accessing the main application state. This isolation held firm on its own. However, the shared chat also included an interactive graph that loaded MathLive, a mathematics library, into the main page.

MathLive includes a listener for messages regarding its on-screen keyboard. Parameter found that this listener accepted messages from any sender without verifying the source origin. Crucially, these messages were permitted to carry raw HTML data intended for keyboard layout customization. The malicious Preview frame exploited this by sending a crafted message containing attacker-controlled HTML to the MathLive listener on the main page.

This HTML created a new frame that the browser treated as part of the trusted chatgpt.com domain, bypassing the sandbox. To execute the final payload, the attackers leveraged YouTube scripts, which were whitelisted in ChatGPT’s content security policy. While inline code was blocked, scripts from allowed domains like YouTube could run within this newly created trusted frame, giving the attacker full control over the session.

Key details

• The vulnerability was reported on October 18, 2026, and fixed by October 26, 2026.
• OpenAI rated the issue P1, its highest severity category, after initially classifying it as P2.
• The attack required no user installation or additional login steps beyond opening a shared link.
• Exploitation relied on MathLive accepting unverified cross-frame messages containing raw HTML.
• Attackers used whitelisted YouTube scripts to bypass content security policies and execute code.
• Parameter received a $5,000 bounty for the responsible disclosure of the flaw.

Why it matters

This incident highlights the risks inherent in complex web applications that integrate third-party libraries and dynamic content rendering. For engineers building AI interfaces, it underscores the importance of strict validation for cross-frame communication. Even when sandboxes are implemented correctly, vulnerabilities can arise from how different components interact. The reliance on external libraries like MathLive introduces supply chain risks that must be managed through rigorous input validation and origin checking.

For product teams, the speed of OpenAI’s response demonstrates the value of robust bug bounty programs and clear incident response protocols. The ability to detect, reproduce, and patch a P1 vulnerability within eight days minimizes potential damage. However, the fact that the flaw allowed full account compromise serves as a reminder that shared features must be designed with least-privilege principles in mind, ensuring that preview modes cannot escalate privileges to the main application context.

What you can do

• Verify that all cross-frame message listeners validate the origin of incoming messages.
• Avoid allowing raw HTML injection through message payloads, even for configuration data.
• Review content security policies to ensure only necessary domains are whitelisted for scripts.
• Implement strict sandboxing for all user-generated content previews and interactive elements.
• Conduct regular security audits focusing on interactions between third-party libraries and core app logic.
• Encourage responsible disclosure by maintaining an accessible bug bounty program for your products.