A security research team found a way to take over any ChatGPT account simply by getting the victim to open a shared conversation link, according to a technical disclosure published by Parameter Labs on October 28. The company reported that OpenAI fixed the vulnerability on October 26 and classified the report as P1, its highest severity rating.
The finding is a rare end-to-end account takeover against a mainstream AI platform, and it landed as the latest AI developments keep showing how much sensitive material people now keep inside chat applications. Parameter Labs said the attack required no app installation, no developer tools, and no interaction beyond opening the attacker's shared ChatGPT URL.
How the Attack Chain Worked
The chain abused two ordinary ChatGPT features that looked harmless in isolation: an interactive graph and the HTML Preview sandbox. ChatGPT's Preview feature runs generated HTML in a restricted frame on a separate web address, which should prevent it from touching the signed-in chatgpt.com page around it.
The breakthrough came from the graph, which loaded a math library called MathLive. That library installed a message listener in the main ChatGPT page for its on-screen keyboard, but Parameter Labs found the listener accepted messages from any origin without verifying the sender. One accepted message type could replace the virtual keyboard layout with attacker-controlled HTML, which MathLive then inserted into the real ChatGPT page through innerHTML.
Scripts inserted that way do not normally execute, so the researchers wrapped their payload in an iframe using the srcdoc attribute. Because the main ChatGPT page created that frame without a sandbox, the browser treated the code inside it as genuine chatgpt.com content with access to the parent page.
Escaping the Content Security Policy
ChatGPT's Content Security Policy still blocked inline scripts, but Parameter Labs found a gap: the policy allowed scripts from YouTube. The researchers discovered that YouTube's oEmbed endpoint reflected an invalid JSONP callback parameter into its error response before validation, letting them prepend executable JavaScript to a response the browser would happily load as a script.
At that point the team had arbitrary JavaScript running with chatgpt.com's identity inside the victim's signed-in session. Parameter Labs was explicit about what that meant in practice: the payload was not limited to modifying the page or displaying an alert — it could directly call ChatGPT's authenticated APIs as the victim. In testing, the payload could enumerate the victim's conversation list, retrieve the contents of private conversations that were never shared with the attacker, and send that data to an external server. The browser identified every action as coming from chatgpt.com itself, giving a victim no visible signal that anything was wrong.
One Link Was Enough
What turned a research bug into a practical weapon was delivery. The researchers put the graph and a previewable HTML block into a single ordinary conversation, published it with ChatGPT's normal sharing feature, and sent the resulting /share/ link by the same routes anyone would use: email, chat, a support ticket, or a social post.
In the most stable reproduction, the victim had to click ChatGPT's Preview button once after opening the link. A later version marked the HTML block as previewable, so ChatGPT opened it automatically and the victim's only required action was visiting the URL. The team reproduced that fully automatic path three times in a separate account, including after a hard refresh, with the payload firing roughly 4.5 seconds after the page loaded.
Because the graph and the preview loaded independently, the payload could occasionally fire before MathLive was ready. The final version retried its messages for a limited period to handle that race condition.
Disclosure and Fix
Parameter Labs reported the issue to OpenAI, which shipped a fix on October 26 and rated the report P1. The disclosure arrives amid a broader run of AI platform security research; earlier this week The Register reported bugs in five AI developer tools, some still unpatched at publication.
The lesson generalizes beyond one library. Modern chat applications compose third-party components, sandboxed previews, and permissive message channels in a single authenticated page, and any unverified postMessage receiver can become the bridge between them. For users, the practical guidance is unchanged from classic web security: treat links to shared AI conversations the way you treat any other unsolicited link, because the platform can no longer promise that opening one is harmless.
For its part, OpenAI's P1 classification and fast turnaround suggest the company treats browser-based session attacks on chatgpt.com as first-tier threats. The incident is also a reminder of how much value concentrates in these accounts now that users store work documents, medical questions, and private projects in chat history — exactly the content Parameter Labs proved an attacker could have extracted.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
