Researchers Found a Way to Take Over OpenAI 's ChatGPT Accounts With Just a Link

What you could do with it

• An attacker could create a malicious ChatGPT conversation, publish it with the normal share feature, and send the link to a signed-in user to exfiltrate that user's private conversation data to an external server ².
• A security researcher could use the discovered flaw to demonstrate that opening any shared ChatGPT link while logged in grants full access to the victim's authenticated account session ².
• An attacker could read content from private conversations never shared with them and perform actions on the victim's ChatGPT account without the victim installing anything or opening developer tools ².

From the announcement: a browser developer tools network tab displaying HTTP request details from ChatGPT, including query strings with 'chatgpt-privileged-client-v3' and API endpoint paths

Picture: parameter.ai

How the trick worked

The problem started with two features that looked harmless on their own: the graph tool and the HTML Preview window.

When ChatGPT creates an HTML preview, it runs the code inside a restricted frame on a different web address. The browser treats that frame as a separate website, so the code inside should not be able to read or touch the main ChatGPT page around it. That part worked as intended — at least until the researchers traced one unexpected connection.

OpenAI uses the MathLive JavaScript library to support math graphs. MathLive includes its own virtual keyboard, and that keyboard can be triggered from inside the sandboxed frame using a browser feature called postMessage(). The code on the main page that receives those messages then uses innerHTML, a method that inserts raw HTML into a page. Because there was no check stopping other sandboxed frames from calling that same method, any iframe — including a preview window — could inject custom HTML into the main ChatGPT page ².

From there the path was clear. The injected HTML created a new iframe without sandbox restrictions. OpenAI's content security policy (CSP) rules blocked inline scripts and only allowed code from a few trusted domains. One of those allowed domains was YouTube. The YouTube oEmbed endpoint could be made to return JavaScript, which then ran inside the victim's signed-in session ¹.

Once the attacker's code was running as the logged-in user, it could call ChatGPT's private APIs directly. It could list all of the victim's conversations, read content from private chats that had never been shared, and send all of that data to an external server — for example by hiding it inside an image URL ².

What was possible

The researchers confirmed they could create a malicious conversation, publish it using ChatGPT's normal share feature, and send the link to another person. When the victim opened the link, the payload ran automatically with full access to that person's authenticated session on chatgpt.com. No app installation, no project join, no developer tools, no pasting code — just opening the link ².

The fix and the reward

OpenAI fixed the vulnerability on October 26, 2026, and classified the report as a P1 — the highest severity level. The company paid Parameter Labs a $5,000 bug bounty. Blog writer Simon Willison said he thought the payout was too low for a flaw this serious ¹.

This story reports on a trend for information only. It is not advice or encouragement to do any of it.

Key facts

• Parameter Labs found a P1 vulnerability in ChatGPT that let an attacker run JavaScript in a victim's signed-in session by sharing a link.
• The exploit crossed a sandbox boundary using MathLive's postMessage() and innerHTML to inject a new unrestricted iframe.
• YouTube's oEmbed endpoint was used as a loophole to load and execute JavaScript under OpenAI's content security policy.
• OpenAI fixed the issue on October 26, 2026, and paid a $5,000 bug bounty.
• No action was needed from the victim beyond opening the shared link.

Sources

1. How We Took Over ChatGPT Accounts
2. Do the Math: How We Took Over ChatGPT Accounts