What happened
Parameter, an AI security company, published its findings on October 28. It reported the issue to OpenAI's bug bounty program on October 18; OpenAI fixed it on October 26, classified it as P1 and paid a total bounty of $5,000.
According to Parameter, the attacker code could list the victim's conversations, read a private conversation that was never shared and send its content to an outside server, effectively taking over the ChatGPT account. In the most reliable version the victim clicked ChatGPT's normal Preview button once; in another, opening the link was the only action.
How the chain worked
ChatGPT runs HTML Preview code in a sandbox on a separate web address. But an interactive graph in the same conversation loaded the MathLive library, which installed a message listener in the main ChatGPT page that accepted messages from any origin. The Preview sent it a new keyboard layout containing HTML, which MathLive inserted into the page without sanitizing.
That HTML was an iframe using srcdoc, which ran with chatgpt.com's identity. ChatGPT's Content Security Policy blocked inline scripts but allowed YouTube, and a YouTube oEmbed endpoint returned the attacker's callback as JavaScript, a JSONP-style bypass. Exported as a public share, the conversation preserved the whole chain.
What it means for you
There is nothing to patch on your side; Parameter says OpenAI confirmed that its web frontends now reject the messages. Neither Parameter nor OpenAI reports exploitation in the wild, and OpenAI has not published its own advisory.
The broader lesson is that combining harmless features, such as previews and graphs, can open a path across a sandbox. Treat shared AI chat links like any other link from an unknown sender, and review the apps connected to your ChatGPT account.
Go to the source
Sources & further reading
Based on the official documentation below. Features and access can change; check the provider before making a decision.
Was this page useful?
Help us make our coverage more useful. This is feedback on the page, not a rating of the tool.
Go a little further