OpenAI Fixed ChatGPT Share-Link Flaw That Let Attacker Code Read Private Chats, Researchers Say

A shared ChatGPT conversation could be turned into a trap. That is the finding of Parameter, a security firm that says it got attacker-controlled JavaScript running inside the logged-in session of anyone who opened a booby-trapped link.

Parameter reported the flaw through OpenAI's bug bounty program on October 18. According to the researchers, OpenAI fixed it on October 26 and classified the report P1, the company's most serious category.

What the researchers say they could do

The attack started with an ordinary public ChatGPT share. An attacker builds a conversation, publishes it with the normal sharing feature, and sends the link by email, chat message, support ticket or social post.

When the victim opened it, Parameter says, the payload ran as chatgpt.com with access to the victim's authenticated web session. The victim did not have to install anything, join a workspace or sign in through the attacker.

In the researchers' proof of concept, the code listed the victim's recent conversations, opened a private chat that had never been shared with the attacker, and sent a portion of it to a server the researchers controlled.

The code did not just copy what was on screen. It called ChatGPT's own authenticated APIs directly. "Essentially, we could perform any action on behalf of the victim's ChatGPT account," the researchers wrote.

How the chain worked

Parameter's write-up describes two features that looked harmless alone: an interactive graph and an HTML Preview.

Preview turns a block of HTML in a chat into a small working web page. Because that page can contain any code, ChatGPT runs it in a restricted frame on a separate web address. Parameter says that isolation held. Code in the Preview could not read the main ChatGPT page.

The way around it came from the graph. Drawing it loaded a math library called MathLive into the main ChatGPT page, and that load installed a listener for messages about MathLive's on-screen keyboard.

Browsers let frames pass messages to each other through an API called postMessage. Parameter compares it to a mail slot: the sandboxed Preview cannot walk into the main page, but it can drop a message through. That is safe only if the receiver checks who sent the message.

According to Parameter, the MathLive listener did not check for the setting the researchers targeted. It accepted a message changing the keyboard layout, and that layout could contain raw HTML. The Preview could therefore hand attacker HTML to the trusted page.

That HTML built a new frame the browser treated as part of chatgpt.com. A script loaded from YouTube then supplied the code that ran inside it.

The last step exploited ChatGPT's content security policy, which limits where a page's scripts can come from. Parameter says the policy blocked inline code but allowed scripts from YouTube, which is why that step worked.

How many clicks it took

In the most reliable version of the attack, the victim opened the link and clicked the Preview button once. In a later version, Parameter set the page to open Preview automatically, so opening the link was the only step required. Parameter's own write-up states that opening the shared link was the only required action.

What is and is not established

This was a controlled test. Parameter does not report any real-world use of the flaw. It ran its private-chat demonstration between separate accounts it controlled, not against real users.

OpenAI's response, as Parameter describes it, was quick: eight days from report to fix, with the top severity label attached. The sandbox design itself worked as intended. The failure was a message listener that trusted any sender.

The researchers' account of the technical details is the only description of the bug in the public record. OpenAI has not published its own account of the flaw or of what it changed. Nor has it said whether it checked logs for abuse between the October 18 report and the October 26 fix, or before it.

The larger exposure is what sits inside a ChatGPT account. Conversations can hold personal, financial and business material, and a script running with full web access to the account can reach all of it, not just the chat the attacker wants.

The next piece of information to watch is whether OpenAI publishes its own technical statement on the fix and whether it says the flaw was never used outside Parameter's tests.