ChatGPT shared link flaw could have exposed private chats

The shared link vulnerability

Security researchers at Parameter discovered a flaw in the ChatGPT shared-conversation feature. The bug could have allowed an attacker to run code inside a victim's logged-in session. This access was possible simply by getting a user to open a specially crafted shared link.

These links could have been distributed through common channels like email, social media, or messaging platforms. Because they looked like ordinary public links, users might have clicked them without realizing the risk. One version of the attack required the user to click a Preview button, while another could have triggered automatically.

Once the exploit was triggered, the attacker-controlled code ran within the victim's active session. This allowed the attacker to list recent conversations and even open private chats that were never shared. The researchers demonstrated that the code could transmit portions of these private conversations to a server under their control.

How the exploit worked

The vulnerability resulted from several separate features interacting in an unsafe way. ChatGPT uses a feature called Preview to render HTML within a conversation. Normally, this HTML runs inside a restricted browser frame, which is a sandbox designed to keep the code isolated from the main interface.

The escape from this sandbox occurred because of a mathematics library called MathLive. This library loaded within the main ChatGPT page to display an interactive graph. MathLive left behind a listener that accepted messages regarding its on-screen keyboard without verifying where those messages actually came from.

Parameter found that the untrusted Preview frame could send messages to this listener. These messages contained raw HTML that the main page then accepted into its trusted context. This allowed the researchers to create a new frame that the browser treated as belonging to chatgpt.com, effectively bypassing the intended security boundaries.

Bypassing security policies

Even with the browser's content security policy in place, the attackers found a way through. The policy blocked inline scripts but allowed scripts from certain approved sources. To complete the exploit, the researchers used a script loaded from YouTube to execute code inside the trusted context.

The researchers emphasized that YouTube itself was not the underlying weakness in the system. Instead, the core issue was the improper validation of cross-frame messages. Because the application failed to check the origin of these messages, untrusted content could pass HTML into the main application.

This design weakness meant the potential access extended beyond a single conversation. The flaw theoretically allowed an attacker to perform any action with the same web privileges as the logged-in victim. This includes calling ChatGPT's own authenticated APIs directly from within the active session.

OpenAI's response and fix

OpenAI responded quickly after the researchers reported the vulnerability through its bug bounty program on October 18. The company reproduced the issue and upgraded its severity from P2 to P1, which is its highest category. They then deployed fixes across two versions of the ChatGPT web frontend by October 26.

The fix specifically prevents the application from accepting the malicious messages required for the exploit. The researchers confirmed that both affected versions of the web frontend now reject these messages. OpenAI paid the Parameter team a total bug bounty of $5,000 for their work.

The firm stated that their testing was conducted in a controlled environment. They reported that they had no evidence the vulnerability was exploited against real users. Because the fix is already live, users do not need to perform any specific remediation steps like resetting accounts or installing updates.

Broader security implications

This incident serves as a reminder of the risks involved in complex web applications. A feature that is safely sandboxed on its own can become dangerous when another component accepts untrusted content. The interaction between the Preview feature, the MathLive library, and the browser frames created a path for exploitation.

For platforms that handle private conversations and authenticated account data, strict separation is critical. Developers must ensure that untrusted content cannot pass through to trusted application functions. This case highlights how design weaknesses in one area can compromise the security of the entire system.

Moving forward, this research underscores the importance of verifying the origin of all messages in a multi-frame environment. As AI platforms become more interactive, the ways in which different libraries and features communicate will remain a primary focus for security researchers. Constant auditing of these interactions is necessary to prevent similar exploits.