ChatGPT Account Hijack: One Shared Link Was Enough

How a shared ChatGPT link became an account hijack

The exploit relied on a chain of small weaknesses that added up to full JavaScript execution inside ChatGPT's parent page.

Parameter Labs found that ChatGPT's HTML previews, the feature formerly known as Canvas, run in a sandboxed iframe. That sandbox is supposed to keep untrusted HTML away from OpenAI's APIs and user data. But the team discovered a postMessage handler in the parent page that used innerHTML to render MathLive's virtual keyboard, and it accepted messages from any frame.

That meant a malicious HTML preview could inject HTML into the parent. While innerHTML doesn't run script tags directly, it can create a new iframe without sandbox restrictions. OpenAI's Content Security Policy blocked inline scripts and limited script sources to a few domains, but YouTube was on the list. The YouTube oEmbed endpoint could be tricked into reflecting JavaScript that executed in the ChatGPT context.

Once JavaScript ran on the parent page, the attacker could fetch private user data from APIs and exfiltrate it through an image reference. A crafted share URL, when opened by another signed-in user, could steal their data or perform actions on their behalf. As we reported in our earlier coverage of the ChatGPT account takeover via shared link, the attack surface around shared content is wider than it looks.

The $5,000 question: was the bounty too low?

OpenAI closed the vulnerability and paid a $5,000 bug bounty. The researcher behind the find thinks that's a bit cheap for a flaw this serious.

A $5,000 reward is on the lower end for a vulnerability that allows account takeover and data exfiltration on a product with hundreds of millions of users. For comparison, critical bugs in widely used platforms often command bounties in the tens of thousands. The researcher's comment, shared by Simon Willison, suggests the payout didn't match the impact.

OpenAI has not publicly detailed the fix, but the company's bug bounty program continues to accept reports. The incident highlights the risks of complex web applications that blend third-party libraries, sandboxed content, and permissive script sources. It also echoes the kind of supply-chain risk we saw in the RAMBO air-gap attack, where a small component opened a big door.

What this means for ChatGPT users

If you use ChatGPT's shared links or HTML previews, be cautious about opening links from untrusted sources.

The flaw has been patched, so there's no action needed for most users. But the episode is a reminder that shared links can be attack vectors, even on trusted platforms. ChatGPT's HTML previews are designed to run interactive content, and that flexibility can be abused.

OpenAI recommends users keep their apps updated and report suspicious activity. The company has not said whether it will increase bounties for similar flaws.

Availability and pricing

The exploit affected ChatGPT users globally, but OpenAI has fixed the issue. No specific regional impact has been reported. The bug bounty program is open to researchers worldwide, with rewards varying by severity.

The ChatGPT account hijack is a textbook example of how small oversights in complex web apps can cascade into serious security holes. OpenAI's quick fix is reassuring, but the low bounty might discourage future research.