We Took over ChatGPT Accounts

Your shared ChatGPT conversations could have exposed private chats and account access to attackers.

Researchers at Parameter Labs discovered a critical vulnerability in ChatGPT that allowed them to hijack user accounts. By crafting a malicious conversation and sharing a link, an attacker could execute arbitrary JavaScript within a victim's authenticated session simply by opening the link. This JavaScript could access private conversations, enumerate a user's chat history, and even make authenticated API calls on behalf of the victim. The exploit chained together two features: an interactive graph that loaded a vulnerable math library (MathLive) and an HTML Preview feature that bypassed ChatGPT's sandbox. The MathLive library had an insecure message listener that accepted commands from the Preview. This allowed the attacker to inject HTML, and subsequently, JavaScript into the main ChatGPT page. Further exploitation involved using YouTube's oEmbed endpoint to bypass Content Security Policy, enabling full account takeover. OpenAI patched the vulnerability on October 26, 2026, classifying it as P1 severity.

This vulnerability highlights a significant risk when integrating complex features like interactive graphs and code previews within platforms that handle sensitive user data. The exploitation chain, which leveraged a seemingly innocuous message passing mechanism between sandboxed previews and the main application, underscores the difficulty in maintaining robust security boundaries. Attackers can discover novel pathways across these boundaries by combining unintended interactions between seemingly unrelated features, posing a threat beyond traditional cross-site scripting vectors. The successful bypass of Content Security Policy via a third-party service (YouTube) further illustrates the interconnected nature of web security and the potential for vulnerabilities to cascade.

The ease with which this account takeover could be initiated—solely by clicking a shared link—indicates a potential for widespread impact if exploited in the wild. It suggests that features designed for convenience and collaboration, such as content sharing, can inadvertently become vectors for sophisticated attacks. The fact that OpenAI classified it as P1 and fixed it rapidly points to the severity of the risk, but it also prompts scrutiny into how such integrations are vetted for security. Future platform development will likely need to incorporate more stringent testing for inter-feature communication and stricter sandboxing, especially when third-party integrations are involved.