How a shared ChatGPT link could hijack user accounts via sandbox escape

In October 2026, security researchers discovered a critical vulnerability in ChatGPT that allowed account takeover through a simple shared link. By exploiting a flaw in how the platform handled interactive graphs and HTML previews, attackers could inject malicious JavaScript into a victim’s authenticated session. OpenAI classified the issue as P1 severity and deployed a fix on October 26, 2026.

What happened

The vulnerability enabled an attacker to create a malicious conversation and publish it using ChatGPT’s standard sharing feature. When a victim opened this public link, the payload executed within their signed-in session on chatgpt.com. This execution context granted the attacker full access to the victim’s account, allowing them to enumerate private conversations, retrieve unshared message content, and exfiltrate data to external servers.

Crucially, the attack required no action from the victim beyond clicking the link. They did not need to install any applications, join specific projects, or open developer tools. In some variations of the exploit, the malicious code executed automatically upon page load, while others required a single click on the "Preview" button. The researchers confirmed that the injected code could call ChatGPT’s authenticated APIs directly, effectively performing any action the victim could perform.

The exploit chain relied on two seemingly harmless features: an interactive graph and the HTML Preview function. The graph loaded a math library called MathLive, which installed a message listener in the main page. The HTML Preview, running in a restricted sandbox, sent crafted messages to this listener. Because the listener lacked proper origin checks, it accepted instructions from the untrusted preview frame, leading to a breach of the sandbox boundary.

How it works

The core of the exploit involved bypassing the browser’s same-origin policy using the postMessage API. While the HTML Preview ran on a separate domain to isolate it from the main ChatGPT interface, it could still send messages to the parent window. MathLive, used for rendering mathematical expressions, listened for these messages to update its virtual keyboard layout. However, it did not verify the source of the messages, allowing the preview frame to send arbitrary commands.

The attacker sent a message instructing MathLive to update its keyboard layout with custom HTML. MathLive inserted this HTML into the main page using innerHTML. Although script tags inserted this way do not execute immediately, the attacker included an iframe with a srcdoc attribute. This created a new document within the main page that inherited the chatgpt.com origin. Since this new frame was not sandboxed, it could access the parent page’s DOM and cookies.

To execute JavaScript despite ChatGPT’s Content Security Policy (CSP), the attacker leveraged YouTube’s oEmbed endpoint. The CSP allowed scripts from YouTube, and the oEmbed endpoint supported JSONP callbacks. By crafting a specific callback parameter, the attacker tricked YouTube into returning a JavaScript response that executed their code. This final step gave them arbitrary code execution within the victim’s authenticated session.

Key details

• Vulnerability Type: Cross-site scripting (XSS) via sandbox escape and insecure postMessage handling.
• Affected Component: ChatGPT web frontend, specifically the interaction between HTML Preview, MathLive, and the main page.
• Attack Vector: A publicly shared ChatGPT conversation link containing a malicious graph and HTML preview.
• Impact: Full account takeover, including reading private conversations and executing API calls as the victim.
• User Action Required: None in some cases; otherwise, a single click on the "Preview" button.
• Resolution: OpenAI fixed the issue on October 26, 2026, by rejecting cross-frame MathLive messages and updating CSP rules.

Why it matters

This incident highlights the risks of complex feature interactions in modern web applications. Individual components like sandboxes, CSPs, and message listeners may be secure in isolation, but their combination can create unexpected vulnerabilities. For developers building AI interfaces, it underscores the importance of rigorous origin checking for postMessage listeners and avoiding the insertion of raw HTML from untrusted sources.

For users, it serves as a reminder that shared links from AI platforms can carry active threats. Unlike traditional phishing attacks that rely on deception, this exploit leveraged legitimate platform features to deliver malware. Organizations should consider restricting access to public shares or implementing additional verification steps for external content until such vulnerabilities are fully mitigated.

What you can do

• Verify the sender before opening shared ChatGPT links, especially from unknown sources.
• Monitor your account activity for unusual API calls or conversation access logs.
• If you are a developer, ensure all postMessage listeners validate the event.origin and event.source.
• Avoid using innerHTML to insert content from untrusted frames; use text content or sanitized HTML instead.
• Implement strict CSP policies that disallow inline scripts and limit trusted domains to essential services only.
• Keep your browser and security extensions up to date to benefit from the latest protective measures.