Critical ChatGPT Flaw Allowed Attackers to Execute Arbitrary Code and Read Private Conversations via Shared Links

Security researchers at the cybersecurity firm Parameter have uncovered a high-severity vulnerability in ChatGPT that could have allowed malicious actors to execute arbitrary code within a victim’s active web session simply by tricking them into opening a specially crafted shared chat link. The flaw, which granted unauthorized access to sensitive user data and private chat histories, was promptly reported to OpenAI and subsequently resolved across the platform’s web infrastructure.

The discovery highlights the intricate security challenges facing modern generative artificial intelligence platforms, particularly as they integrate complex web features like interactive previews, third-party libraries, and cross-frame communication channels. According to Parameter, the vulnerability was officially disclosed to OpenAI’s bug bounty program on October 18. Following a swift investigation and verification process, OpenAI classified the issue as a P1 vulnerability—its most severe category—and deployed a comprehensive fix across two distinct versions of the ChatGPT web frontend by October 26.

The Anatomy of the Attack

The attack vector relied on an ordinary ChatGPT conversation shared through the platform’s standard public link functionality. Because the link appeared identical to any legitimate shared chat, it could be distributed through conventional channels without raising suspicion, including email messages, direct chat platforms, IT support tickets, or public social media posts.

Crucially, the exploitation process required minimal interaction from the victim. The user was not required to install any third-party software, join a compromised workspace, or authenticate through an attacker-controlled portal. In the initial proof-of-concept developed by Parameter, the victim simply needed to open the link and click ChatGPT’s built-in Preview button once. In a subsequent, more refined version of the exploit, the researchers configured the landing page to trigger the Preview mode automatically, reducing the required user action to a single click on the link itself.

Once the page loaded, malicious code executed directly within the context of the victim’s authenticated ChatGPT session, inheriting the exact permissions and privileges associated with the user’s real browser session. Rather than merely scraping the visible contents of the screen, the injected script interacted directly with ChatGPT’s signed-in application programming interfaces. This allowed the attacker’s code to query the victim’s recent conversation list, open private chats that had never been shared externally, and transmit portions of that confidential data back to a remote server controlled by the researchers.

Parameter emphasized that the investigation was conducted in a controlled environment as part of responsible security research. The firm confirmed that no real-world exploitation of the vulnerability was detected, and all proof-of-concept testing was performed between isolated accounts rather than targeting unsuspecting platform users.

Breaking Out of the Sandbox

The vulnerability originated from a complex interaction between multiple frontend features within ChatGPT’s web application. ChatGPT includes a functionality that allows a block of hypertext markup within a chat to be rendered as a localized web page via a feature called Preview. Because these preview frames can execute arbitrary code, the platform isolates them within a locked-down frame on a separate web origin, preventing them from accessing or interacting with the primary ChatGPT application domain.

While this fundamental sandboxing mechanism functioned as intended, security researchers identified a bypass stemming from a secondary feature embedded within the same conversation. Alongside the preview element, the shared chat contained an interactive data visualization graph. Rendering this graph required the application to load an external math rendering library known as MathLive into the main ChatGPT web page.

The inclusion of the math library left an active event listener running on the main page, designed to process messages concerning the library’s on-screen virtual keyboard. In web security, communication between different browser frames must be strictly governed by origin checks to verify the identity of the message sender. However, Parameter discovered that the MathLive event listener accepted keyboard-related messages from any originating source without proper validation. Furthermore, these incoming messages were improperly permitted to contain raw HTML data.

This oversight allowed the isolated Preview frame to breach the security boundary by passing crafted HTML payload directly to the trusted primary page. Once received, the injected HTML dynamically constructed a new frame that the victim’s browser interpreted as a legitimate part of the primary chatgpt.com domain. To supply the executable payload within this newly forged frame, the script loaded resources originating from YouTube.

The choice of YouTube as a resource source circumvented ChatGPT’s strict Content Security Policy, which successfully blocked inline script execution but permitted scripts loaded from trusted external domains like YouTube. Parameter noted that the YouTube integration served merely as the final mechanism to deliver the code, rather than being the root cause of the vulnerability itself. Simply blocking external script sources would not have resolved the underlying architectural flaw that allowed an untrusted preview frame to inject raw HTML into the main application.

Resolution and Industry Response

Following the responsible disclosure submitted on October 18, OpenAI engineers reproduced both the arbitrary code execution and the unauthorized private chat access demonstrated by Parameter. Acknowledging the severity of the architectural oversight, OpenAI elevated the issue from a secondary priority to a P1 designation.

Over the course of eight days, development teams rolled out targeted patches across two versions of the ChatGPT web frontend. By October 26, the updated web application actively rejected the insecure cross-frame messages that enabled the attack chain, effectively neutralizing the vulnerability.

Because the security update was implemented entirely on the server and frontend infrastructure managed by OpenAI, platform users were not required to take any manual action, install updates, or reset credentials. Following the successful deployment of the fix, Parameter published its technical analysis of the vulnerability on October 28. In recognition of the critical nature of the finding and the thoroughness of the report, OpenAI awarded the research team a bug bounty of $5,000.