Checked fact 33171 Nov 2026Safety and security

Parameter says an interactive graph loaded the MathLive library, which installed a postMessage listener in the main ChatGPT page, and that the listener's origin policy was none, so it accepted messages from any web address.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

an origin policy of none

What the source said when we opened it, on 1 Nov 2026.

The source

We found a gap at OpenAI
Parameter Labs · 2026-10-28

Open the source archived copy

Checked

Checked by the notis newsroom on 1 Nov 2026, against the source above.

In the story

Shared ChatGPT link could run attacker code in viewer's session, Parameter Labs says 1 Nov 2026

Cite this fact

Short permanent address

In a sentence

“Parameter says an interactive graph loaded the MathLive library, which installed a postMessage listener in the main ChatGPT page, and that the listener's origin policy was none, so it accepted messages from any web address.” ai notis, checked 1 Nov 2026. Source: We found a gap at OpenAI (Parameter Labs). https://ainotis.com/c/3317

As a reference (APA style)

ai notis. (2026, November 1). Parameter says an interactive graph loaded the MathLive library, which installed a postMessage listener in the main ChatGPT page, and that the listener's origin policy was none, so it accepted messages from any web address [Checked claim 3317]. ai notis. https://ainotis.com/c/3317

Anyone may quote this address. It does not change; if we correct the story, this page says so.