A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

Researchers at security firm Parameter found that a malicious shared ChatGPT link could run an attacker's code inside the logged-in session of anyone who opened it, allowing access to private conversations. The flaw was reported through OpenAI's bug bounty program on October 18, fixed eight days later, and rated P1, OpenAI's most serious category. The attack used an ordinary shared chat and did not require the victim to install software, join a workspace, or sign in through the attacker.

What the flaw allowed

Once the link opened, the code ran with the same access as the real ChatGPT site. It listed recent conversations, opened a private chat that had never been shared with the attacker, and sent a small portion of it to a server controlled by the researchers. Because it called ChatGPT's signed-in APIs directly, the researchers said it could perform actions on behalf of the victim's account. The work was a controlled test, Parameter reported no real-world use, and the private-chat proof ran between separate accounts.

How the attack worked

ChatGPT's Preview feature can turn a block of HTML in a chat into a small web page, which runs in a locked-down frame on a separate web address. That sandbox held. The way in came from an interactive graph in the same shared chat: drawing it loaded the MathLive library into the main ChatGPT page. Loading MathLive left a listener for messages about its on-screen keyboard, and Parameter found that it accepted a keyboard message from any sender. That message was allowed to carry raw HTML, letting Preview hand attacker HTML to the trusted main page. The HTML built a new frame that the browser treated as part of chatgpt.com, and a script loaded from YouTube supplied the code. ChatGPT's content security policy blocked inline code but allowed scripts from YouTube.

What OpenAI changed

OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1, and rolled a fix across two versions of ChatGPT's web frontend. By October 26, both versions rejected the messages the attack relied on. Parameter traced the problem to three design choices: MathLive acted on a message that changed its settings without checking which frame sent it; that message was allowed to carry raw HTML as keyboard-layout data; and the HTML could create a frame that was not sandboxed and inherited the chatgpt.com identity. The YouTube step was only the final workaround, not the cause.

What users need to do

ChatGPT users do not need to take any action. The fix is on OpenAI's side, with nothing to install or reset. Parameter published its writeup on October 28, after the fix, and OpenAI paid a total of $5,000 for the report.

Sources: The Hacker News