A security flaw in ChatGPT’s shared-conversation feature could have allowed attackers to run code inside a victim’s logged-in session and access private conversations simply by getting the user to open a specially crafted shared ChatGPT link, according to researchers at security firm Parameter.
The researchers reported the vulnerability to OpenAI through its bug bounty programme on October 18. OpenAI reproduced the issue, upgraded its severity from P2 to P1, its highest category, and deployed fixes across two versions of the ChatGPT web frontend by October 26.
Parameter publicly disclosed the research on October 28 after the issue had been fixed. The firm said its testing was conducted in a controlled environment and that it had no evidence the vulnerability had been exploited against real users.
Malicious Shared Link Could Reach Private Chats
The attack started with what appeared to be an ordinary public ChatGPT conversation link.
Such a link could have been distributed through email, messaging platforms, support tickets or social media in the same way as any legitimate shared conversation.
In one version of the attack, the victim had to open the shared chat and click ChatGPT’s Preview button once. Parameter later demonstrated a version in which Preview could be triggered automatically, meaning opening the malicious link could be enough to begin the exploit chain.
Once triggered, the attacker-controlled code ran within the victim’s signed-in ChatGPT session.
The researchers demonstrated that it could list recent conversations, open a private chat that had never been shared with the attacker and transmit a small portion of that conversation to a server under their control.
Parameter said the code was not limited to reading information displayed on the screen. Instead, it could call ChatGPT’s own authenticated APIs directly from within the victim’s active session.
That meant the potential access extended beyond a single conversation.
The researchers said the flaw could theoretically have allowed an attacker to perform actions with the same web privileges available to the logged-in victim.
Preview and MathLive Features Combined to Break Isolation
The vulnerability depended on several separate features interacting in an unsafe way.
ChatGPT can render HTML contained in a conversation through a feature called Preview. Because such HTML could contain executable code, Preview normally runs inside a restricted browser frame hosted separately from the main ChatGPT interface.
According to Parameter, that sandbox itself worked as intended.
The escape path emerged through another feature in the same shared conversation.
The chat contained an interactive graph that caused a mathematics library called MathLive to load within the main ChatGPT page. MathLive left behind a listener that accepted messages relating to its on-screen keyboard.
Browser frames can communicate with one another through messages, but applications normally need to verify where those messages originated.
Parameter found that the MathLive listener accepted certain messages without adequately checking the sender.
Those messages could also contain raw HTML as part of keyboard-layout data.
This allowed the untrusted Preview frame to send attacker-controlled HTML into the trusted ChatGPT page.
That HTML then created another frame that the browser treated as belonging to chatgpt.com.
Because ChatGPT’s content security policy blocked inline scripts but permitted scripts from certain approved sources, the researchers used a script loaded from YouTube as the final step to execute code inside the trusted context.
Parameter stressed that YouTube itself was not the underlying weakness. The core issue was that untrusted content could pass HTML into the main application through an improperly validated cross-frame message.
OpenAI Classified Vulnerability as P1 and Fixed It
Parameter said OpenAI was able to reproduce both the code-execution issue and the proof showing access to a private conversation.
The company subsequently raised the vulnerability to P1 severity and deployed changes to prevent the malicious messages from being accepted.
By October 26, the researchers said both affected versions of the ChatGPT web frontend rejected the messages required for the exploit.
The issue was traced to a combination of three design weaknesses: MathLive accepted configuration-changing messages without properly verifying their origin, those messages could carry raw HTML, and the injected HTML could create a non-sandboxed frame that inherited the trusted ChatGPT origin.
OpenAI paid Parameter a total bug bounty of $5,000 for the report.
No Evidence of Real-World Exploitation
The research does not indicate that attackers used the vulnerability against ChatGPT users in the wild.
Parameter said the private-chat demonstration was carried out only between controlled accounts belonging to the researchers.
The vulnerability has also already been fixed on OpenAI’s side, meaning users do not need to install an update, reset their accounts or take any other specific remediation step related to this flaw.
The incident nevertheless highlights the security risks that can arise when multiple interactive web features operate within the same application.
A feature that is safely sandboxed on its own can become dangerous when another component accepts untrusted messages or content without sufficiently verifying its origin.
For platforms handling private conversations and authenticated account data, strict separation between untrusted content and trusted application functions remains critical.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
