OpenAI has paid researchers at Parameter $5,000 after they showed that a booby-trapped ChatGPT share link could take over the logged-in session of whoever clicked it and expose their private chats. It was fixed within eight days, but both the bug and the modest reward deserve attention from UK organisations.
What happened
Parameter, a security research firm, submitted the issue to OpenAI’s bug bounty programme, which is run on Bugcrowd, on 18 October 2026. Their timeline shows the core weakness confirmed on 13 October and a variant that needed nothing beyond opening the link working by 17 October.
OpenAI reproduced the problem on 21 October and moved it from its initial P2 triage up to P1, the top of its severity scale. The fix rolled out across ChatGPT’s two web frontends, and on 26 October OpenAI confirmed both were safe, closed the report and paid $5,000. Parameter published a detailed write-up on 28 October, and wider press coverage followed on 31 October.
The fix was made on OpenAI’s side, so ChatGPT users do not need to update or reset anything. Parameter tested only between its own accounts, and no abuse of real users has been reported.
The technical picture
This was a cross-user account takeover delivered through ChatGPT’s own sharing feature. An attacker would publish a crafted conversation as a normal public share and circulate the link. When a signed-in victim opened it, attacker-supplied JavaScript ran as chatgpt.com with the victim’s session.
No single component was obviously broken. ChatGPT’s Preview feature, which renders HTML code blocks as small web pages, already runs that content in an isolated frame on a separate address, and that isolation held. The weakness lay next to it. A maths graph placed in the conversation loaded MathLive, an open source maths input library, into the main ChatGPT page. MathLive set up a cross-frame message listener for its on-screen keyboard, and that listener did not check where incoming messages came from. Because keyboard layout data could contain raw HTML, the sandboxed Preview could push markup into the trusted page.
That markup could create a new, unsandboxed embedded document which inherited ChatGPT’s identity. ChatGPT’s content security policy blocked inline scripts, but it trusted YouTube as a script source, and a YouTube endpoint could be persuaded to return attacker-controlled script. Parameter is clear that YouTube merely offered a way round the policy; it was not the root cause.
Once code was running in that context, it could call ChatGPT’s authenticated back-end APIs directly. In testing, Parameter enumerated a victim’s chats, retrieved a private one the attacker had no access to and exfiltrated a sample to its own server. In principle, anything the web app can do was within reach.
Why it matters for UK organisations
ChatGPT is now routine in UK offices, often with staff on personal or Plus accounts alongside, or instead of, managed Team and Enterprise workspaces. Staff paste in contracts, customer emails, code and HR material. A flaw that can quietly read conversation history is, in practice, a data exposure route into whatever your staff have discussed with an AI assistant, and under UK GDPR that history may well include personal data your organisation is responsible for.
The delivery method also makes it worse. A chatgpt.com share link looks entirely legitimate. It would pass most email filters and the usual “check the domain” advice. Shared conversations are now a normal way to pass ideas between colleagues and suppliers, which is exactly the kind of trusted channel attackers look for.
There is a supply chain point too. MathLive is used well beyond ChatGPT. Ostorlab, which analysed the disclosure, notes that the public write-up does not name a fixed upstream release, so UK developers who embed the library in their own products should not assume they are covered just because OpenAI has fixed its own site.
Expert view
From a testing point of view, this is a textbook example of a bug that lives in the joins between features. When we scope a web application test, we tend to look at each feature in turn: the sandbox, the content security policy, the third-party libraries, the sharing model. Each of those would probably have passed here. The vulnerability only appeared when a graph, a preview, a messaging listener, a script allowlist and public sharing were all combined in one page. In my experience, chains like this come from a curious human asking what a sandboxed component can still talk to, not from a scanner.
OpenAI deserves credit for its response. Triage in three days, a prompt severity upgrade and a fix in eight days is better than many vendors manage.
The payout is harder to defend. OpenAI itself rated this one-link account takeover P1. Yet $5,000 is modest for a one-click account takeover on a platform of this size, and below the $6,000 Xint says OpenAI paid it for a reasoning-theft bypass, which we reported on 27 October. Bounty tables are a market signal: if the reward for a critical, reliable chain on a flagship product looks small, some skilled researchers will take their time elsewhere, or take their findings to buyers who pay more.
What to do now
- Know where ChatGPT is used. Find out which teams use personal accounts versus managed workspaces, and move business use onto accounts you can govern. This sits under the Cyber Essentials user access control requirements.
- Set clear rules on what goes into AI tools. Treat conversation history as a data store. Keep special category personal data, credentials and client-confidential material out of it unless a managed workspace and a data protection impact assessment cover that use.
- Update awareness training. Make the point that a link on a trusted domain, including share links from AI tools, can still be malicious. Unexpected shared conversations deserve the same caution as unexpected attachments.
- Developers: audit cross-frame messaging. If your applications embed MathLive or any component that listens for postMessage events, confirm that handlers check both the sender’s origin and the exact sending window, that settings received from other frames are never written to the page as HTML, and that dynamically created frames stay sandboxed. This maps to the Cyber Essentials secure configuration and security update management controls.
- Review your CSP allowlists. Every third-party script domain you trust is a possible bypass. Narrow the allowlists where you can, and treat CSP as a backup control, not your main defence.
- If you run a bounty programme, benchmark your rewards. Make sure critical account takeover findings are rewarded in proportion to their real business impact.
Bottom line
A single shared ChatGPT link was enough to read someone’s private conversations, and the bug came from features that each looked safe on their own. OpenAI fixed it quickly, but UK organisations should treat AI chat history as sensitive data, warn staff that trusted-domain links can be hostile, and check their own code for similar cross-frame flaws. Vendors should ask whether $5,000 keeps researchers reporting bugs like this.
Sources
- Parameter: Do the Math: How We Took Over ChatGPT Accounts
- The Hacker News: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
- ShiftDelete: ChatGPT Shared Link Flaw Let Attackers Read Your Private Chats
- Ostorlab: ChatGPT Shared-Link Account Takeover via MathLive Sandbox Escape
