Researchers demonstrate ChatGPT account takeover through a shared link

Overview

Updated 1 hour ago

On October 31, Parameter Labs published a chain that turned an ordinary public ChatGPT conversation into an account takeover. A victim only had to open the shared link. The code ran inside their signed-in session and could list conversations, read a private chat and send the contents out.

The entry point was a graph that loaded MathLive, a math-input library, plus an HTML preview that could send it messages. MathLive accepted a keyboard-layout update from any frame and inserted the supplied HTML into the main page, creating an unsandboxed frame with ChatGPT's identity. OpenAI fixed the chain on October 26 and rated it P1.

Why it matters

A shared link can carry code into your signed-in session, so every private chat is one click from exposure.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

$5,000

OpenAI bounty

Total award for the account-takeover report.

ChatGPT frontends patched

OpenAI rolled the fix across two versions of the web app.

Clicks needed in stable version

The victim opened the share and clicked Preview once.

~4.5 seconds

Time to execution

In the automatic-preview version, the payload ran about 4.5 seconds after opening.

Severity rating

OpenAI's priority classification for the report.

Voices

Curated perspectives — historical figures and your fellow readers.

Organizations Involved

Parameter Labs

Security research firm

Disclosed the account-takeover chain

The firm found and published the ChatGPT share-link exploit.

OpenAI

AI company

Patched both web frontends and paid a $5,000 bounty

OpenAI operates ChatGPT, the product whose share links carried the exploit.

MathLive

Open-source software library

Its message listener accepted the malicious update

MathLive renders editable math in the browser and was loaded by the graph in the malicious conversation.

Timeline

3 events Latest: Yesterday

October 2026
Parameter Labs publishes the attack chain
Latest Disclosure

The writeup shows a shared link running code in a victim's session and reading a private chat.
Yesterday
OpenAI patches the ChatGPT share-link exploit
Fix

OpenAI rejects the cross-frame MathLive messages on both web frontends and rates the report P1.
6 days ago
OpenAI pays a $5,000 bounty
Bounty

The company awards a total of $5,000 for the account-takeover report.
6 days ago

Scenarios

OpenAI publishes a root-cause postmortem

Possible Resolves by End of 2026

Discussed by: Parameter Labs and security researchers discussing the disclosure

OpenAI has confirmed the fix but has not published its own account of how the MathLive listener, the HTML preview and the YouTube endpoint combined. A postmortem would name the code changes and say whether other cross-frame listeners were audited. The company has published technical postmortems for earlier security incidents.

A second ChatGPT share-link escape surfaces

Uncertain Resolves by Apr 30, 2027

Discussed by: Parameter Labs, which noted the fix addressed the reported messages rather than every possible cross-frame path

The researchers wrote that blocking only the YouTube endpoint would have left an untrusted Preview able to insert HTML. If other components in ChatGPT accept messages from Preview frames, a second chain could work. A public report would need to show code execution from a share link after the October fix.

MathLive adds sender checks for its message listener

Likely Resolves by Jan 31, 2027

Discussed by: Security engineers responding to the disclosure

The vulnerable listener belonged to MathLive, not ChatGPT. OpenAI's fix rejects the cross-frame messages on its own frontends. Other sites that embed MathLive may still accept the same update-setting message. A release that validates the sender's origin and window would close that wider exposure.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

October 2005

MySpace Samy worm (2005)

Samy Kamkar added JavaScript to his MySpace profile. The code copied itself into the profiles of visitors and added them as friends. It spread to more than a million profiles before MySpace took the site offline.

Then

MySpace removed the worm and patched the profile vulnerability. Kamkar faced criminal charges.

Now

The case became a standard example of how a trusted social page can execute code in a visitor's browser.

Why this matters now

The ChatGPT chain used the same trust boundary: a page one user shares, opened inside another user's logged-in session.

September 2018

Facebook 'View As' token theft (2018)

Facebook's 'View As' feature let users see their profile as someone else. Attackers exploited a chain of three bugs in that feature to steal access tokens. Facebook said about 29 million users had names or contact details taken and reset tokens for 90 million accounts.

Then

Facebook fixed the flaw and logged out affected users.

Now

Regulators in the United States and Europe opened investigations, and the incident became a reference case for session-token theft.

Why this matters now

The ChatGPT bug also turned a normal feature interaction into session-level access, letting code act as the victim rather than merely read a page.