Hackers Claim to Have Compromised ChatGPT Accounts
Executive Summary
"Cybercriminals are reportedly exploiting a vulnerability in ChatGPT, claiming to have gained unauthorized access to user accounts through shared links. This breach raises serious concerns about the security of AI platforms and user data."
Hackers Claim Exploit Allowed Takeover of ChatGPT Accounts via Shared Links
Imagine clicking a seemingly innocent link to a shared ChatGPT conversation, only to have your account compromised, your private chats exposed, and potentially your identity used to interact with the AI. That chilling scenario is no longer theoretical, as a security research team claims to have discovered a critical vulnerability in OpenAI's widely-used AI chatbot that could allow malicious actors to take over user accounts.
The researchers, operating under the banner of parameter.ai, detailed their findings this past week, revealing a sophisticated exploit that leverages two seemingly innocuous features within ChatGPT: its HTML Preview capability and its interactive graph generation. The exploit, patched by OpenAI on October 26th and classified as a Priority 1 (P1) vulnerability, highlights the complex security challenges inherent in powerful AI platforms.
The Unassuming Gateway: Graphs and Previews
The vulnerability chain reportedly began with a simple question: What could a previewed HTML code block, isolated within a restricted frame, still communicate with? ChatGPT's HTML Preview feature allows users to generate a small, functional webpage from code snippets. To prevent malicious code execution, these previews are typically sandboxed in a separate origin. However, the researchers found a way to bypass this isolation.
The exploit involved embedding a malicious HTML snippet within a shared ChatGPT conversation. This snippet, when rendered, leveraged a library called MathLive (used for interactive graphs) to install a listener on the main ChatGPT page. Crucially, this listener was designed to accept messages related to MathLive's on-screen keyboard. The researchers then crafted a message that updated the keyboard's layout with their own HTML, which included a script designed to execute within the main ChatGPT session.
The critical flaw lay in MathLive's message handling. It accepted messages that could alter the keyboard's layout, allowing arbitrary HTML to be injected. This HTML was then processed by a helper function that, rather than sanitizing it, marked it as trusted and passed it through. This paved the way for inserting an `iframe` with the `srcdoc` attribute, which created a new, unsandboxed document that inherited the `chatgpt.com` web identity of the main page.
This allowed arbitrary JavaScript to run with the same authenticated context as a logged-in user.
src="https://www.parameter.ai/labs/images/openai-public-share-modified-page.png" alt="Diagram showing how a public share modified the real ChatGPT page."The public share modified the real ChatGPT page, allowing malicious code execution within the user's session.
Bypassing Security Policies and Exfiltrating Data
Even with JavaScript execution, ChatGPT's Content Security Policy (CSP) presented a hurdle, blocking inline scripts. The researchers found a clever workaround by exploiting YouTube's oEmbed endpoint. By crafting a specific URL with a JSONP-style callback parameter, they could trick the browser into loading a JavaScript response from YouTube, which was permitted by ChatGPT's CSP. This response contained their malicious payload, effectively executing arbitrary JavaScript within the `chatgpt.com` origin.
Once the code was running with the user's authenticated session, the implications were severe. The researchers demonstrated that their payload could enumerate the victim's conversation list, retrieve content from private conversations that had never been shared with the attacker, and send this data to an external server. This was not merely screen scraping; it was direct access to ChatGPT's internal APIs as the authenticated user.
src="https://www.parameter.ai/labs/images/openai-private-chat-exfil-proof.png" alt="Controlled proof that private conversation data could leave the victim's session."Researchers demonstrated that private conversation data could be exfiltrated to an attacker-controlled server.
The entire exploit could be triggered simply by a victim clicking on a specially crafted shared ChatGPT link. No additional installations, logins, or user actions beyond opening the link were required. OpenAI confirmed the vulnerability and fixed it on October 26, 2026, classifying it as a P1 severity issue and awarding the researchers a bounty of $5,000.
What Went Wrong and Lessons Learned
The parameter.ai team identified three key design decisions that, when combined, led to the exploit: MathLive accepting state-changing messages without verifying the sender's origin, the allowance of raw HTML in keyboard layout data, and the creation of unsandboxed documents inheriting the parent page's identity.
The incident underscores the critical need for robust security practices in AI platforms. While individual features like sandboxing and message passing are designed with security in mind, their interaction can create unforeseen vulnerabilities. The researchers emphasized that isolation is only as strong as every bridge across it, and cross-frame messages must be rigorously authenticated. Furthermore, dynamic documents generated from untrusted input should remain strictly sandboxed, and CSP should serve as a defense-in-depth measure, not the sole barrier.
As AI chatbots become more integrated into our daily lives and professional workflows, ensuring the security of user data and accounts is paramount. This incident serves as a stark reminder that even the most advanced AI systems are susceptible to complex, multi-stage attacks that exploit subtle interactions between their components.