OpenAI Patches ChatGPT Share-Link Flaw That Hijacked Sessions

A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, according to researchers at the security firm Parameter. The Hacker News reported that OpenAI shipped a server-side fix eight days after Parameter's October 18 report, rated it P1, and paid a $5,000 bounty.

The chain stitched three design flaws together. ChatGPT's Preview feature wraps user-supplied HTML in a locked-down frame on a separate origin so it cannot read the main chatgpt.com page. But when Preview rendered interactive graphs, ChatGPT also pulled in the MathLive math library on the main page, and MathLive listened for cross-frame messages about keyboard settings. "A message passed between browser frames is safe only if the receiver checks who sent it," the researchers wrote; Parameter found the listener "accepted a keyboard message from any sender, and that the message was allowed to carry raw HTML." From there, "That HTML built a new frame that the browser treated as part of chatgpt.com. A script loaded from YouTube then supplied the code that ran inside it." YouTube was already on ChatGPT's content security policy allowlist, so the final payload loaded without complaint.

The victim did not have to install anything, join a workspace, or sign in through the attacker. In the most reliable version, they "opened the link and clicked ChatGPT's Preview button once." In a later version Parameter set the page to open Preview automatically, so clicking the link was the only step.

Once inside the chatgpt.com origin, the attacker's script could enumerate the victim's recent conversations, read private chats that had never been shared, and call ChatGPT's authenticated APIs directly. "Essentially, we could perform any action on behalf of the victim's ChatGPT account," the researchers wrote. OpenAI reproduced both the code-execution and private-chat proof-of-concept, escalated the severity from P2 to P1, rolled a fix across two versions of ChatGPT's web frontend, and closed the issue on October 26. The patch was entirely server-side; users had to do nothing. The disclosure, by The Hacker News reporter Swati Khandelwal, lands in a dense run of AI-app security coverage — close to two hundred items on our cybersecurity tracker over the last 90 days.