ChatGPT account hack opening a shared link let attackers steal private conversations

How it works

A website where you type messages and get replies from an artificial intelligence.

1. 👥You share a ChatGPT conversation, receiving a web link.
2. 📨Someone sends you that shared link.
3. 🖱️You click the link and open it in your browser.
4. ⚡Hidden code runs automatically on the page.

Words to know

• sandbox: A security feature that keeps untrusted code contained so it cannot access your personal data or other parts of a website
• iframe: A way to embed one webpage inside another, like a window within a window
• JSONP: An old web technique that lets websites load data from other sites using special callback parameters

An exampleInvented to explain it

a user named Marco checking a forwarded link

ColleagueThis AI chat has some clever tricks, want to see?

MarcoSure, send me the link so I can try it.

ColleagueHere you go: https://chatgpt.com/share/abc123

MarcoOpening it now…

Marco's private conversations were exposed to the attacker.

The vulnerability

In October 2026, a research team discovered a way to turn a normal public ChatGPT share into attacker-controlled JavaScript running inside whoever opened it ¹.

An attacker could craft a deceptive conversation, share it through ChatGPT's built-in sharing tool, and forward the resulting link to a target user. When the target opened the shared link, the malicious payload ran under the chatgpt.com domain and gained access to the victim's logged-in web session ¹.

Researchers verified that the code could list the victim's conversations, pull material from a private chat the attacker had never seen, and exfiltrate that content to an outside server ¹.

How it worked

The attack exploited two features that looked harmless on their own: a graph tool and an HTML Preview ¹.

ChatGPT's Preview feature can render an HTML code block into a functional mini webpage. Since that page may contain arbitrary code, ChatGPT runs it inside a restricted frame on a different web address ¹.

Behind the scenes, the graph loaded a math library called MathLive. Opening it placed a message listener inside the main ChatGPT page, set up to catch messages tied to MathLive's virtual on-screen keyboard ¹.

Browsers use postMessage to let two frames exchange information even when they cannot read each other's pages. It works like a mail slot: the sandboxed Preview page cannot step into the main page, but it can still pass notes through the opening ¹.

MathLive accepted the message without checking who sent it. The listener picked up a command that altered the virtual keyboard's layout, and that layout was permitted to include HTML ¹.

Once the keyboard appeared, MathLive injected an iframe via srcdoc, a browser capability that embeds HTML directly inside an attribute of the frame tag ¹.

The iframe was created without a sandbox attribute. Since the parent ChatGPT page created the iframe, the browser assigned it the chatgpt.com origin. Code inside the new frame could therefore access the parent page ¹.

No action needed by the victim

The victim did not need to install anything, take part in a project, paste code, or access developer tools. The only action required was opening the shared link.

This is unusual for browser-based account takeovers, which typically require users to click suspicious downloads or paste code into developer consoles.

The fix

OpenAI patched the vulnerability on October 26 and rated the report as P1, the highest severity level ¹.

What this means for users

This vulnerability affects anyone who uses ChatGPT's conversation sharing feature. If you regularly share or open shared ChatGPT links, be cautious about unexpected invitations to view conversations.

The attack demonstrates how combining two safe features can create an unsafe path. Developers should review similar integrations where third-party libraries listen for messages without verifying their origin.

This story reports on a trend for information only. It is not advice or encouragement to do any of it.

If you are struggling, help is available: in Italy call 112 or Telefono Amico on 02 2327 2327; elsewhere, your local emergency number.

Corrections and updates

• Corrected on 11 November 2026. An earlier version of this story included details its sources do not support. They have been corrected or removed.

Guess

What severity rating did OpenAI give this vulnerability?

MediumUnratedP1 (highest)

Key facts

• Opening a shared ChatGPT link could let attackers hijack your account
• No app install or code pasting was required - just clicking a link
• Attackers could read private conversations and send data to external servers
• OpenAI fixed the bug on October 26, 2026 and classified it as P1 severity
• The vulnerability came from combining a graph tool with HTML Preview features

Sources

1. Do the Math: How We Took Over ChatGPT Accounts — parameter.ai