ChatGPT Account Takeover: One Shared Link Was Enough, Researchers Say

How a simple share link became an attack vector

The attack started with two innocuous features: an interactive graph and an HTML Preview. The graph loaded MathLive, a math library that installed a message listener on the main ChatGPT page. That listener accepted messages from any origin and allowed HTML injection into the virtual keyboard layout.

Parameter's research team found that ChatGPT's HTML Preview, which runs code in a sandboxed iframe on a different domain, could still communicate with the main page via postMessage. The graph feature loaded MathLive, which set up a listener for on-screen keyboard messages. Crucially, MathLive's controller used an origin policy of 'none', meaning it accepted messages from any website. The Preview could therefore send a message that replaced the keyboard layout with attacker-controlled HTML.

When the keyboard was shown, MathLive inserted the HTML into the main ChatGPT page using innerHTML. A helper function called createHTML marked the string as trusted instead of sanitizing it, allowing the HTML to pass through. Script tags inserted this way don't execute, but the team used an iframe with srcdoc to create a new document. Because the main page created the frame, it inherited the chatgpt.com origin and could access the parent page.

Bypassing CSP with YouTube's JSONP endpoint

ChatGPT's Content Security Policy blocked inline scripts but allowed scripts from YouTube. The team exploited YouTube's oEmbed endpoint, which supported a JSONP-style callback parameter and failed to properly validate it, to load and execute their JavaScript inside the new frame.

With arbitrary JavaScript running as chatgpt.com, the attackers could call ChatGPT's authenticated APIs as the victim. They demonstrated enumerating the victim's conversation list, retrieving content from a private conversation that had never been shared, and exfiltrating that data to an external server. The victim only had to open the shared link; no app installation, project joining, or code pasting was required.

The first version of the exploit used a researcher-controlled ChatGPT App as the sender, which would have required the victim to connect or invoke that app. The team then found a way to deliver the payload through a native HTML attachment that opened in the same sandboxed Preview. However, when exporting the conversation as a public share, the attachment remained but the graph did not, complicating real-world delivery. The researchers continued to refine the attack.

OpenAI's response and what it means for users

OpenAI fixed the vulnerability on October 26 and classified the report as P1, its highest severity level. The company has not publicly detailed the fix, but the flaw is now patched.

The P1 classification indicates that OpenAI considered the issue critical. The attack chain relied on a combination of a third-party library (MathLive) with permissive message handling and a CSP that allowed scripts from YouTube. It is unclear whether OpenAI modified MathLive's configuration, tightened CSP, or implemented additional sandboxing. The researchers have not released the full exploit code, but their write-up provides enough detail for other security teams to understand the technique.

For ChatGPT users, the immediate risk is gone, but the incident highlights the dangers of feature-rich web applications. The attack required no user interaction beyond opening a link, making it a potent phishing-style vector. Users should remain cautious about opening shared links from untrusted sources, even on platforms they trust.

What it means for you

The vulnerability affected all ChatGPT users, but it has been fixed as of October 26. No action is required from users. OpenAI has not disclosed whether the flaw was exploited in the wild. For those in the US, UK, and EU, the same patch applies globally, as ChatGPT is a cloud service.

The ChatGPT account takeover is a stark reminder that AI platforms are not immune to traditional web security pitfalls. While OpenAI's rapid fix is reassuring, the incident underscores the importance of rigorous security reviews for every new feature, no matter how harmless it seems.