Security firm Parameter published an exploit chain in which an attacker publishes a malicious conversation through ChatGPT's normal sharing feature; when a signed-in victim opens the /share/ link, the payload runs as chatgpt.com in their session, lists conversations, reads a private chat that was never shared, and sends data out. Parameter reported it through OpenAI's bug bounty on October 18; OpenAI raised it from P2 to P1, fixed it on October 26 and paid a $5,000 bounty. Parameter reports no real-world use, and users do not need to do anything.
Key Takeaways
- ✓Timeline: reported Oct 18; OpenAI reproduced it Oct 21 and raised it from P2 to P1; both web frontends fixed by Oct 26; published Oct 28 (Parameter writeup)
- ✓Very low bar: no app install, project join or pasted code; in the auto-preview variant, opening the link was the only action, firing after about 4.5 seconds (per Parameter)
- ✓Three root causes: MathLive did not check the message sender, the message could carry raw HTML as keyboard-layout data, and that HTML could create an unsandboxed iframe with the chatgpt.com identity; YouTube JSONP was only the final CSP bypass
- ✓Bounty was $5,000; Simon Willison called it "a bit cheap" for a flaw this serious (blog)
- ✓MathLive 0.111.2 (Oct 31) now defaults to same-origin validation and blocks cross-window custom HTML layouts (changelog)
Key Decision Metrics at a Glance
Turn your technical choice into a development budget
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background
ChatGPT share links are usually treated as harmless read-only pages. On October 28, Mukul Goyal of security firm Parameter showed that, before OpenAI's October 26 fix, a crafted public share could run attacker JavaScript as chatgpt.com in the signed-in session of anyone who opened it. As chat products add interactive graphs and HTML previews, the share page becomes an authenticated attack surface.
How the chain worked
A genuine graph in the conversation loaded the MathLive math library in the main page, which installed a postMessage listener for its virtual keyboard. A later HTML Preview, isolated on a separate sandbox origin, could still message the main page. MathLive did not check the sender and accepted raw HTML as keyboard-layout data, and that HTML could create an unsandboxed iframe that inherited the chatgpt.com identity. The Content Security Policy blocked inline scripts, so the researchers used YouTube JSONP to get around it. The payload then called authenticated APIs such as /backend-api/conversations, read a private conversation never shared with the attacker, and sent part of it out through an image request.
Numbers (no benchmark)
This is security research, so there is no benchmark. Per Parameter's timeline: path confirmed on production code Oct 13, reported Oct 18, reproduced by OpenAI and raised from P2 to P1 on Oct 21, one frontend fixed Oct 22, both fixed and resolved Oct 26, total bounty $5,000. The auto-preview variant was reproduced three times and fired after about 4.5 seconds. Parameter says testing was between its own accounts and reports no real-world use.
What developers should do
ChatGPT users need to do nothing. Teams building AI apps should validate origin and source window in every postMessage handler, never let cross-window messages carry renderable HTML, treat share pages as auth surfaces that should not ride the viewer's session, and audit JSONP endpoints allowed by CSP. Apps embedding MathLive can upgrade to 0.111.2 (Oct 31), which defaults to same-origin validation and blocks cross-window custom layouts.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.