Researchers at parameter.ai reported that a public ChatGPT share link could be built to run code in the browser session of anyone who opened it, and that this code could read the victim's private conversations. OpenAI fixed the issue on October 26, 2026, and classified the report as P1, according to the source.
What the researchers say an attacker could do
According to the source, the attack required nothing from the victim except opening a link. An attacker would create a conversation, publish it through ChatGPT's normal sharing feature, and send the link by email, chat, a support ticket or a social post. When the victim opened it, the code ran with the victim's signed-in access to chatgpt.com.
The report says that access was enough to list the victim's conversations, retrieve content from a private conversation that had never been shared with the attacker, and send a piece of that data to an external server. The authors state that the code could call ChatGPT's authenticated interfaces as the victim, which they describe as taking over the account. They did not say how much data was actually sent off-site beyond 'a small piece' of one response.
How the flaw was reached, at a high level
The report says the chain combined several features that each looked harmless: a Preview feature that renders HTML code blocks as small webpages, an interactive math graph, and a math keyboard library called MathLive. Preview runs in an isolated frame on a separate web address, which is meant to keep it away from the signed-in page.
The problem, as the researchers describe it, was that a component in the main page accepted instructions from the isolated frame without checking where they came from, and the content it accepted could contain HTML. The authors also say a third-party media domain allowed by ChatGPT's content security policy played a role. A content security policy limits which scripts a page may load. The researchers argue it should be a backup control, not the only barrier once attacker-controlled HTML reaches the page.
The source includes implementation detail for defenders. This article leaves that detail out, because the fix is reported as deployed and the general pattern is what developers need to understand.
Did the sandbox fail?
The report says the Preview sandbox worked as intended. Code inside Preview could not read the main ChatGPT page. The failure, in the authors' account, was that a second component trusted an untrusted sender.
The researchers list three design decisions that turned that mistake into a full exploit: a state-changing message was accepted without verifying the sender, the message format allowed raw HTML as data, and a dynamically created document inherited ChatGPT's web identity. For developers, the lesson is that blocking one endpoint would not have closed the path. Each of the three decisions had to change.
What OpenAI did and when
According to the source, OpenAI reproduced both the script execution and the private-conversation proof, then classified the report as P1. The fix was rolled out across two versions of ChatGPT's web frontend. During the rollout, content security policy changes blocked part of the chain while one version still needed an update.
On October 26, OpenAI confirmed that both versions rejected the cross-frame messages used in the report and marked the issue resolved. The source does not say whether any user data was accessed outside the research, how many accounts might have been affected, or whether OpenAI has published its own advisory. The article itself is dated 31 October 2026.
What should ChatGPT users do now?
The source reports the fix but does not give user instructions. The steps below follow from the report and general security practice, not from OpenAI guidance:
- Treat shared ChatGPT links from unknown senders as untrusted content, the same way you would treat an unexpected attachment.
- Do not assume a link is safe because a known contact forwarded it, since accounts can be compromised.
- If you use ChatGPT for sensitive work, check your signed-in sessions and sign out of any you do not recognise.
- Watch for an official OpenAI security notice for affected versions. The source does not link to one.
Who it is for and where it falls short
This report matters most to security teams that manage ChatGPT access for staff, to developers who build web interfaces with embedded frames or third-party widgets, and to anyone who regularly shares conversations. It matters less to people who only use ChatGPT inside the official app and never open links from others.
The report has clear limits. The findings come from one research team, and the claims are the authors' own. The source does not say they were independently verified. The write-up also includes reproduction detail, so it will be read by people who may try variants. Because the fix is reported as deployed, the immediate risk is lower, but the source does not say whether similar patterns exist elsewhere in ChatGPT or other products.
Bottom line: The report describes a serious cross-user flaw that OpenAI says is fixed as of October 26, 2026. Treat shared links from strangers as untrusted, and treat the researchers' account as credible but unverified until OpenAI or an independent party publishes more detail.
Source and verification: This article is based on a research write-up titled 'Do the Math: How We Took Over ChatGPT Accounts', published by parameter.ai's research team on 31 October 2026 (parameter.ai research write-up). The fix date and P1 classification are as reported by the researchers, not confirmed in this article against an OpenAI statement. No GitHub figures apply.
Related: Anthropic Reportedly Limits Claude on Video Game Reverse Engineering · Sam Altman Says OpenAI's AI Math Releases Will Continue
Comments (0)