OpenAI resolved a high-severity security flaw in ChatGPT on October 26, 2026, after researchers demonstrated that shared conversation links could lead to full account takeover.reported The vulnerability allowed attackers to execute code within a victim’s authenticated session simply by having them open a malicious public share.
What was released or claimed
Parameter Labs reported finding the gap in October 2026.reported Their research team showed that an attacker could create a malicious conversation and publish it using ChatGPT’s normal sharing feature. When a signed-in user opened the link, the payload executed as chatgpt.com. This code could enumerate the victim’s conversation list and retrieve content from private conversations that had never been shared. The payload could also directly call ChatGPT’s authenticated APIs as the victim.
Who it affects
The exploit targeted any user who opened a shared ChatGPT link while signed in. Victims did not need to install an app, join a project, paste code, or open developer tools. The only required action was opening the shared link. The attack chain relied on two features: a graph component and an HTML Preview feature. The graph loaded the MathLive library, which installed a listener in the main page for messages related to its on-screen keyboard.
What is still unknown
The source material does not specify how many accounts were compromised or if the flaw was exploited in the wild before discovery. It is unclear whether OpenAI notified affected users beyond the patch release. The exact code changes OpenAI implemented to fix the innerHTML injection and CSP bypass are not detailed in the reports.reported
What to make of it
The vulnerability stemmed from how ChatGPT handles HTML previews in sandboxed iframes. While the sandbox prevented direct access to the parent page, the MathLive library allowed communication via postMessage. The message-receiving code used innerHTML, enabling untrusted code to inject HTML into the parent page. This injected HTML could create a new iframe without sandbox restrictions. OpenAI’s content security policy blocked inline scripts but allowed script loading from YouTube, whose oEmbed endpoint could reflect JavaScript back for execution.
What buyers should weigh
Organizations using ChatGPT for sensitive workflows should note that shared links previously posed a high risk of data exfiltration. Buyers should verify that any AI platform’s sandboxing mechanisms prevent cross-frame message injection.
Why it matters
- The flaw demonstrated that sandboxed code execution in AI interfaces can be bypassed via legitimate library features, challenging assumptions about isolation effectiveness.
- Account takeover via simple link clicks highlights the persistent risk of phishing-style attacks in authenticated web applications, even with modern security controls.
- The use of third-party libraries like MathLive in critical security boundaries shows how supply chain dependencies can introduce vulnerabilities in AI platforms.
Topics: OpenAI, ChatGPT, security vulnerabilities, sandbox escape, bug bounty
Updated
Story timeline
- 31 Oct 2026 Do the math: How we took over ChatGPT accounts
- 31 Oct 2026 How We Took Over ChatGPT Accounts
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Questions readers ask
Did OpenAI confirm this flaw was exploited in the wild?
The source material does not state whether the vulnerability was exploited before discovery, only that researchers demonstrated the attack chain.
What specific technical weakness allowed the account takeover?
The MathLive library’s use of innerHTML to process postMessage inputs allowed untrusted code to inject HTML and bypass sandbox restrictions.
How much did OpenAI pay for this vulnerability report?
OpenAI paid a $5,000 bug bounty for the report, which OpenAI classified as a P1 severity issue.
Connected stories
Reading receipt
- OpenAI fixed a vulnerability on October 26, 2026, that allowed account takeover via shared conversation links.
- The exploit used the MathLive library to bypass sandbox restrictions and access authenticated user sessions.
- OpenAI paid a $5,000 bug bounty for the report, which OpenAI classified as a P1 severity issue.