Today ainotis Join

My notis

SafetyPublished All news from that day

Shared ChatGPT link could run attacker code in viewer's session, Parameter Labs says

Parameter Labs says a listener in an interactive graph accepted messages from any web address, and that OpenAI fixed the issue and awarded $5,000.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

Share

Check our sources · 9 facts from 1 source

Opening one shared ChatGPT link was enough to run an attacker's code inside a signed-in user's ChatGPT session, according to security researchers at Parameter Labs, and Parameter says OpenAI has fixed it. The account is a write-up by Mukul Goyal on Parameter's Labs pages, dated 28 October 2026.

Parameter says the chain began with an interactive graph that loaded the MathLive library, which installed a message listener in the main ChatGPT page that accepted messages from any web address.

Parameter says the listener took keyboard-layout data containing HTML and inserted it into the page, where the HTML created an iframe with no sandbox, so the frame carried the chatgpt.com identity.

Parameter says ChatGPT's content security policy blocked inline scripts but allowed YouTube, and a callback parameter on a YouTube address let the researchers load their own code from that allowed source.

Parameter says that from there the code could list the victim's recent conversations and read a private conversation that had never been shared with the attacker, and the researchers sent a small piece of it to an outside server as a demonstration.

Parameter says it reported the issue to OpenAI's bug bounty programme on 18 October, that OpenAI reproduced it on 21 October and raised its severity from P2 to P1, and that on 26 October OpenAI confirmed the issue resolved and paid $5,000 in total.

Parameter says the fix landed in two versions of ChatGPT's web frontend, and that both now reject the cross-frame MathLive messages.

Share this story

Your reaction

We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.

Check our sources

Every sentence above is checked against this source.

1 We found a gap at OpenAIParameter Labs · 28 Oct 2026 · 9 facts Open the source archived copy

  1. Parameter Labs says its researchers found a way to run attacker-controlled JavaScript as chatgpt.com in a victim's signed-in session, where the victim only had to open a public ChatGPT share link.

    we found a way to turn an ordinary public ChatGPT share into attacker-controlled JavaScript ... Opening the shared link was the only required action.
    cite

  2. Parameter Labs says the code could call ChatGPT's authenticated APIs as the victim, and that OpenAI has fixed the issue.

    it could directly call ChatGPT's authenticated APIs as the victim. ... OpenAI confirmed both frontends rejected the reported messages, resolved the issue
    cite

  3. The write-up is by Mukul Goyal on Parameter's Labs pages and is dated 28 October 2026.

    Mukul Goyal, published October 28, 2026
    cite

  4. Parameter says an interactive graph loaded the MathLive library, which installed a postMessage listener in the main ChatGPT page, and that the listener's origin policy was none, so it accepted messages from any web address.

    an origin policy of none
    cite

  5. Parameter says the listener accepted keyboard-layout data containing HTML that was inserted into the page with innerHTML, and that the injected HTML created an iframe with srcdoc and no sandbox attribute, which inherited the chatgpt.com identity.

    assigned the attacker-supplied keyboard layout to the real ChatGPT page through innerHTML ... inserted without a sandbox attribute ... inherited the chatgpt.com origin
    cite

  6. Parameter says ChatGPT's Content Security Policy blocked inline scripts but allowed YouTube, and that a YouTube oEmbed JSONP callback parameter let the researchers load attacker code from that allowed source.

    allow scripts from YouTube ... the YouTube oEmbed endpoint supported a JSONP-style callback parameter
    cite

  7. Parameter says the code could list the victim's recent conversations and retrieve the content of a private conversation never shared with the attacker, and that it sent a small selected piece of that data to an external server through an image request as a demonstration.

    list the victim's recent conversations and retrieve a private conversation never shared with the attacker ... sent a small selected portion of that data to an external server through an image request
    cite

  8. Parameter's timeline says it submitted the report to OpenAI's bug bounty programme on 18 October 2026, OpenAI reproduced the issue on 21 October and raised its severity from an initial P2 to P1, and on 26 October OpenAI confirmed both frontends rejected the messages, resolved the issue and awarded 5,000 US dollars in total.

    October 18: report submitted to bug bounty; October 21: reproduced, severity raised from the initial P2 triage to P1; October 26: OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000.
    cite

  9. Parameter says OpenAI fixed the issue across two versions of ChatGPT's web frontend and that both now reject the cross-frame MathLive messages.

    The fix was rolled out across two versions of ChatGPT's web frontend.
    cite

Topics

The morning email

On the mornings we publish: the three top stories and up to four short ones. Free.

We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep