ChatGPT shared links could let attackers read private chats

The hidden vulnerability

Security researchers at the firm Parameter discovered a significant flaw in how ChatGPT handles shared conversation links. They found that a malicious link could execute an attacker's code directly within the logged-in session of anyone who opened it. This gave the attacker the same level of access as the actual user on the site.

The attack did not require the victim to install any software, join a specific workspace, or even sign in through a special portal. A user could be targeted simply by clicking a link sent via email, social media, a support ticket, or a direct message. The researchers noted that the trap appeared as an ordinary conversation shared through the platform's public link system.

In the most reliable version of the exploit, the victim only needed to click the 'Preview' button once after opening the link. However, the researchers also found a version where the page was set to open the preview automatically. This meant that simply clicking the link was enough to trigger the malicious code execution.

Accessing private data

Once the attacker's code ran, it functioned as if it were a legitimate part of the ChatGPT website. The researchers demonstrated that the code could list a victim's recent conversations and open private chats that had never been shared with the attacker. It then sent portions of those private messages to a server controlled by the researchers.

The exploit was particularly potent because it called ChatGPT's own signed-in APIs directly rather than just scraping what was visible on the screen. Because the code operated with the user's complete web permissions, the scope of the attack was not confined to the specific chat being viewed. The researchers noted that they were "Essentially, we could perform any action on behalf of the victim's ChatGPT account."

While the researchers conducted these tests in a controlled environment, the implications were serious. They ran their private-chat proof between separate accounts rather than against real users. Nevertheless, the flaw proved that a single shared link could serve as a gateway to a user's entire private history on the platform.

How the sandbox broke

The vulnerability existed because of how ChatGPT handles the 'Preview' feature, which turns HTML blocks into small web pages. Usually, these pages are held in a locked-down frame called a sandbox to prevent them from reading the main page. This sandbox remained intact, but a second feature in the same conversation provided a way for the attacker to bypass it.

The shared chat also included an interactive graph that loaded a math library called MathLive into the main ChatGPT page. This library left a listener running that accepted messages regarding its on-screen keyboard. Parameter discovered that this listener accepted messages from any sender and allowed those messages to carry raw HTML data.

The Preview frame was able to bridge the gap and deliver malicious HTML to the trusted main page. This HTML then built a new frame that the browser treated as part of the official chatgpt.com domain. To bypass content security policies, the attackers used a script from YouTube to supply the final code that ran inside the frame.

OpenAI's rapid response

OpenAI responded quickly to the report filed through their bug bounty program on October 18. They raised the severity of the flaw from P2 to P1, which is their most serious category. By October 26, they had rolled out a fix across two different versions of the ChatGPT web frontend.

The fix specifically addressed the three design choices that allowed the exploit to work. They updated the system so that the MathLive library would no longer act on messages without checking which frame sent them. They also restricted the ability for those messages to carry raw HTML data, closing the primary bridge between the sandbox and the main site.

The researchers confirmed that both the code execution and the private-chat proof were successfully reproduced before the fix. OpenAI provided a total payment of $5,000 to the researchers for their work. Because the fix is handled entirely on the backend, ChatGPT users do not need to perform any manual updates or reset their accounts to stay protected.