Opening a ChatGPT Link Was Enough to Lose Your Entire Account

⏱️ Reading time: 10 min

Opening a ChatGPT link shared by someone else was enough for an attacker to exploit a ChatGPT vulnerability and take full control of the victim’s account. There was no need to install an app, join a project, or open developer tools: just clicking the link was enough.

📑 En este artículo

1. TL;DR
2. What ChatGPT Is
3. What Happened
4. Context and History
5. Technical Details: How the ChatGPT Vulnerability Works Step by Step
6. Impact and Analysis
7. What’s Next
8. Frequently Asked Questions
   1. What is MathLive and what role did it play in ChatGPT’s flaw?
   2. What did the victim have to do to be exposed on ChatGPT?
   3. What ChatGPT data could an attacker steal with this P1 flaw?
   4. Is the ChatGPT vulnerability still active today?
   5. How does this ChatGPT attack differ from a classic XSS?
   6. How can you avoid a bypass like MathLive’s in your own application?
9. References

Security firm Parameter reported the flaw on October 26, 2026, and OpenAI fixed it that same day, classifying it as P1 severity, the highest level in its bug bounty program. The team published the full technical analysis two days later, on October 28.

TL;DR

• Opening a shared ChatGPT link was enough for an attacker to take full control of the account.
• The chain combined a chart, the MathLive library, and Preview mode to bypass ChatGPT’s sandbox.
• The attack used a YouTube JSONP endpoint to dodge chatgpt.com’s Content Security Policy.
• OpenAI fixed the flaw on October 26, 2026, and marked it as P1 severity.
• Parameter published the full finding on October 28, 2026, with the technical details of the exploit.

What ChatGPT Is

ChatGPT is OpenAI’s artificial intelligence chatbot, built on large language models, that lets users converse, generate code, and share conversations publicly through a link. That sharing feature, combined with Preview mode for running HTML, was the origin of the ChatGPT vulnerability that Parameter reported in October 2026.

The flaw lived in the combination of two features coexisting on the same page: Preview, which runs HTML inside an isolated frame with a different web address, and an interactive chart that loads an external math library called MathLive. Each feature worked as intended on its own.

What Happened

The attack started with a normal ChatGPT conversation that the attacker published using the sharing feature, the same one any user employs to send a chat to a colleague. Inside that conversation there was an interactive math chart and an HTML code block that ChatGPT turns into a small page through Preview.

When the victim opened the link, the chart loaded MathLive on chatgpt.com’s main page and, without anyone requesting it, installed a listener for postMessage messages related to its on-screen virtual keyboard. Preview, on the other hand, ran on a different origin and couldn’t directly read the main page’s document, because the browser’s origin separation prevented it.

But Preview could send a message through postMessage, the mechanism two windows use to communicate even when the browser prevents them from reading each other. MathLive’s listener, installed minutes earlier by the chart, became the mailbox where Preview dropped its payload.

Context and History

ChatGPT has allowed sharing conversations publicly since 2023, and Preview mode, which turns a code block into a working page, was added later so users could test generated code without leaving the chat. Each feature went through its own security reviews separately.

The problem appeared at the intersection of both, a pattern common in complex web applications: two different teams build reasonably secure pieces, but no one checks what happens when those pieces coexist in the same browser tab. MathLive is an open source library for editing math formulas, used by ChatGPT to render equations.

Parameter is a research firm that audits artificial intelligence products. OpenAI runs a public bug bounty program and classified this finding as P1, the most severe category, reserved for flaws that allow user accounts to be compromised without the user doing anything out of the ordinary.

Technical Details: How the ChatGPT Vulnerability Works Step by Step

The flaw wasn’t an isolated oversight, but an overly permissive origin policy in MathLive’s controller. When Preview sent a postMessage message, MathLive’s top-level controller accepted the message without checking who sent it, because its origin setting was fixed at none: the option that accepts senders from any web address.

top.postMessage({
  type: "mathlive#virtual-keyboard-message",
  action: "update-setting",
  layouts: [{
    label: "Compatibility",
    layers: [{ id: "compatibility", markup }]
  }]
}, "*");

top.postMessage({
  type: "mathlive#virtual-keyboard-message",
  action: "show",
  animate: false
}, "*");

The first message replaced the virtual keyboard’s layout with HTML of the attacker’s choosing. The second instructed MathLive to show that keyboard, forcing the library to insert the HTML into chatgpt.com’s actual document. A function called createHTML was supposed to sanitize that string, but it only marked it as trusted and let it pass through untouched into innerHTML.

Inserting HTML with innerHTML doesn’t execute scripts on its own: browsers ignore them by design. To get around that barrier, the injected HTML included an iframe with the srcdoc attribute, which lets a full page be embedded inside another using a text string. MathLive inserted that iframe without the sandbox attribute, so the browser assigned it the identity of https://chatgpt.com and gave it access to the page that contained it.

One obstacle remained. ChatGPT’s Content Security Policy blocks inline JavaScript and restricts which domains can serve scripts, but Parameter’s team found that the policy allowed loading scripts from YouTube domains. They took advantage of a JSONP endpoint (a JSON response wrapped in a JavaScript function) to get the browser to execute arbitrary code disguised as a legitimate call to YouTube.

⚠️ Heads up: A JSONP endpoint on a domain allowed by the Content Security Policy is equivalent to an allowlist with a hole in it: any script that URL can return runs with the privileges of the site that allowed it.

flowchart TD
A["Attacker publishes a ChatGPT conversation"] --> B["Victim opens the shared link"]
B --> C["Preview loads MathLive and triggers postMessage"]
C --> D["MathLive inserts unsanitized HTML into the real DOM"]
D --> E["iframe srcdoc without sandbox executes JavaScript as chatgpt.com"]
E --> F["The script bypasses the CSP with YouTube JSONP"]
F --> G["The attacker reads private chats and calls the authenticated APIs"]

With the script running inside chatgpt.com’s origin, the attacker no longer needed to manipulate the screen or trick the victim into an extra click. The code could call the same internal APIs that ChatGPT’s interface uses to list conversations, read their content, and send the data to an external server, all using the victim’s authenticated session.

Impact and Analysis

The ChatGPT vulnerability wasn’t limited to showing an alert or changing how the page looked: the script could carry out any action the victim could perform within their own account. Parameter confirmed it could enumerate the complete list of conversations, including ones that had never been shared, and extract their content.

What makes this finding more serious than a traditional XSS is the entry vector. The victim didn’t visit a suspicious site or paste code into any console: they opened a ChatGPT link, published through the sharing feature that the product itself promotes so users can exchange useful conversations.

The risk scales with the number of links circulating daily, because the sharing feature gets used for tutorials, demos, and technical support. Any of those links could become, during the exposure window, a silent trap for whoever opened it.

What’s Next

OpenAI deployed the fix that same day, October 26, 2026, before Parameter published the technical details. The repair likely tightened at least three points: MathLive’s origin policy, the sandbox attribute on the generated iframe, and the list of domains allowed in the Content Security Policy for YouTube scripts.

💡 Tip: If your application uses postMessage between windows or iframes, always validate event.origin against an explicit list of trusted domains before processing the message. Never accept the default value that allows any origin.

The case leaves a lesson for any team integrating third-party libraries inside an application with an authenticated session: even if each piece passes its own security review, the combination of pieces needs its own audit. Parameter built the full chain by testing, one by one, what the code inside Preview could reach.

There is, for now, no public evidence that the P1 flaw was exploited against real users before the patch. OpenAI and Parameter coordinated responsible disclosure, with the technical advisory published only after confirming the fix was live in production.

If you develop with iframes, postMessage, or third-party libraries inside an app with an active session, review every message listener today and confirm it validates the origin before reading its content.

Frequently Asked Questions

What is MathLive and what role did it play in ChatGPT’s flaw?

MathLive is an open source library that ChatGPT uses to render and edit math formulas with a virtual keyboard. Its message listener, which didn’t validate origin, was the door an attacker used to inject HTML into ChatGPT’s real page.

What did the victim have to do to be exposed on ChatGPT?

Just open the link to the conversation shared by the attacker. There was no need to install anything, log in again, or interact with any additional element on the page.

What ChatGPT data could an attacker steal with this P1 flaw?

The code could enumerate the victim’s list of conversations, read the content of private chats that had never been shared, and send it to an external server, as well as call the account’s authenticated APIs.

Is the ChatGPT vulnerability still active today?

No. OpenAI fixed the flaw on October 26, 2026, the same day Parameter reported it, before the full technical analysis was published.

How does this ChatGPT attack differ from a classic XSS?

It didn’t rely on injecting a script directly, but on chaining a postMessage bypass, a sanitization flaw in a library, and a Content Security Policy bypass via JSONP to achieve code execution with the site’s identity.

How can you avoid a bypass like MathLive’s in your own application?

Always validate the origin of every postMessage received, sanitize any HTML before assigning it to innerHTML, add the sandbox attribute to iframes with srcdoc, and review which third-party domains your Content Security Policy allows in script-src.

References

• Parameter: full technical report on the vulnerability, “Do the Math: How We Took Over ChatGPT Accounts”.
• MathLive on GitHub: official repository of the math formula editing library used by ChatGPT.
• MDN Web Docs: reference documentation on Content Security Policy and the script-src directive.
• OpenAI: official site of the company responsible for ChatGPT.

📱 Enjoy this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Featured image: Foto de FlyD en Unsplash