Researchers are paid $5K for reporting a bug to OpenAI that would let attackers run code in logged-in sessions of all who opened the hacker's ChatGPT share link

Shared ChatGPT links can now be used to run malicious code in your session, reading your private chats.

Researchers at the security firm Parameter discovered a vulnerability in OpenAI's ChatGPT that allowed them to execute arbitrary code within a logged-in user's session through a shared chat link. The flaw exploited a feature that previews HTML content within a sandboxed frame, combined with a loaded math library (MathLive) that improperly handled messages. This allowed attacker-controlled HTML to be injected into the main ChatGPT page, bypassing security measures. Once executed, the attacker's code could access and read private user conversations by calling ChatGPT's own APIs. Parameter reported the vulnerability to OpenAI on October 18th, who then fixed it within eight days, rating it a P1 severity. OpenAI has since implemented fixes in two versions of its web frontend. The researchers received $5,000 from OpenAI for reporting the bug.

This vulnerability highlights a critical risk in how AI chat platforms handle shared content and integrate third-party libraries. The exploitation chain, involving HTML previews and a math library listener, suggests potential weaknesses in cross-frame communication and content security policies that need rigorous re-evaluation. OpenAI's swift fix and P1 severity rating underscore the seriousness of this oversight, particularly concerning the direct API access achieved by the malicious script.

The incident exposes a broader concern for AI platforms: ensuring the security of interactive features and third-party code integrations. While this exploit required specific conditions and a subsequent fix, it signals the need for more robust sandboxing and stricter validation of message passing between different components of AI applications. Users should remain vigilant about the links they click, even from seemingly trusted sources, as the potential for session hijacking and data exfiltration remains a significant threat.