ChatGPT flaw allowed hackers to steal private chats via shared links

The mechanics of the hijack

A critical security flaw in the ChatGPT web platform recently allowed cybercriminals to seize control of active user sessions. This vulnerability meant that an attacker could steal confidential conversations without needing to guess a user's password or perform complex technical maneuvers. As Escudo Digital reported, the primary method for triggering the attack was simply convincing a victim to open a link that appeared to be a harmless shared conversation.

Once a user clicked the malicious link, a script would run in the background to take control of the session. The code was designed to access the user's private history and immediately transmit that data to an external server controlled by the attacker. This automated process was so efficient that the script could begin scanning internal APIs and extracting data almost instantly.

In a final demonstration of the flaw, researchers showed that the infected preview would deploy itself automatically. The entire process of scanning the platform's internal systems and discreetly extracting the private chats through an image request took only 4.5 seconds. This speed made the threat particularly high-risk for users who might not notice any immediate changes to their interface.

How the security failed

The breach was caused by a specific communication failure between two different components of the ChatGPT platform. Specifically, the issue involved the HTML code preview tool and a third-party math library known as MathLive. While the preview tool is designed to run inside an isolated container, or sandbox, to keep it from interacting with the main page, a loophole existed in how it talked to other libraries.

The MathLive library kept a 'listener' open to receive messages, which was intended to help activate its virtual keyboard. However, the library failed to properly verify the identity of the source sending those messages. This oversight allowed the isolated environment to slip through the security barrier and send instructions directly to the main site. By doing this, the malicious code could inject HTML directly into the user's AI interface.

To get around standard browser shields and the platform's own security policies, the researchers used a sophisticated technical trick. They created a floating frame, or iframe, that inherited the full permissions and identity of the ChatGPT site. To ensure the web would execute the malicious code without being blocked, they utilized a legitimate YouTube connection point that the platform already trusted as a safe source.

Impact on users and data

The vulnerability was categorized as a priority P1, which represents the highest level of severity for a security risk. Because the flaw allowed for the hijacking of active sessions, any registered user who interacted with a malicious link was potentially at risk. The primary concern for these users was the theft of their private chat history, which could contain sensitive personal or professional information.

The attack was particularly dangerous because it did not require the user to provide any credentials or perform any actions other than clicking a link. The automation of the script meant that the theft happened in the background, making it difficult for a casual user to detect. The data was extracted through an image request, a method used to move information out of the site discreetly.

Fortunately, the scope of the vulnerability was limited to the web platform's infrastructure. Because the fix was implemented as a cloud update to the platform itself, the security hole was closed for all users simultaneously. This means that the vulnerability has been resolved without any manual updates or actions required from the end users to secure their accounts.

Resolution and rewards

The security flaw was first reported on October 18 by a researcher named Mukul Goyal, who was working on behalf of the firm Parameter. After the report was submitted, the research team worked to verify the risk and demonstrate the potential for account hijacking. Once the severity was confirmed, the team worked with the platform to ensure the issue was addressed quickly.

OpenAI responded to the report by fixing the flaw on its servers on October 26. Following the successful identification and remediation of the P1 vulnerability, the research team was rewarded with $5,000. This type of reward system is common in cybersecurity to encourage researchers to find and report bugs before they can be exploited by malicious actors.

The resolution of this bug highlights the ongoing effort to secure large-scale AI platforms against sophisticated attacks. While the specific flaw involving the MathLive library and the HTML preview has been patched, it serves as a case study in how small communication errors between different software components can lead to significant security risks. The platform remains updated to prevent this specific chain of failures from occurring again.