What changed
In a technical disclosure published October 28, 2026, Parameter Labs described a vulnerability chain in ChatGPT's public conversation sharing feature. A crafted shared conversation combined a normal interactive graph, which loaded MathLive into the main page, with an HTML Preview in a sandboxed frame. The MathLive virtual-keyboard message receiver accepted a state-changing message from the Preview without verifying its sender, then rendered attacker-supplied markup into the main ChatGPT page. That markup created an unsandboxed same-origin document; a script allowed by the page's Content Security Policy completed the chain. In researcher-controlled tests, code ran as chatgpt.com and retrieved content from an unrelated private conversation. Parameter says it reported the issue October 18; OpenAI reproduced it, rated it P1 and confirmed both web frontend versions fixed by October 26. No public OpenAI incident report or evidence of exploitation in the wild was established.
Why it matters
Many builders now let AI agents, customers and collaborators share generated HTML, dashboards or previews inside authenticated applications. Putting untrusted HTML in a sandbox is necessary but not sufficient when a privileged component in the surrounding page accepts messages from any frame and turns them into markup. This case shows how an apparently isolated preview can borrow the authenticated site's authority without breaking the browser's same-origin policy directly. The operational lesson is to authenticate cross-window messages, avoid rendering raw HTML from message payloads, and keep any derived documents sandboxed. For ChatGPT users, the disclosed exploit is reported fixed server-side; there is no verified need for a user-side patch or password reset based solely on this report.
The sandbox was intact; the trusted listener was not
The HTML Preview could not initially read the parent page. A separate graph feature loaded MathLive, whose virtual-keyboard controller listened for cross-frame messages and accepted a layout update without checking the sender's origin and window. The layout allowed HTML, which was inserted into the privileged document. This is the trust-boundary failure: a component in the trusted page promoted untrusted frame data into page content.
A chain of ordinary browser features reached the signed-in session
The injected markup could create a new iframe without sandbox restrictions and inherit the main site's origin. The page's CSP blocked inline scripts, but an allowed third-party script endpoint was usable as a code-execution gadget. Parameter's controlled proof then called authenticated conversation APIs, listed recent conversations, read a private conversation never shared with the attacker and sent a small selected value to a researcher-controlled endpoint. The team argues the resulting access could have supported other authenticated actions, but those broader actions were not demonstrated in the published proof.
The share link reduced victim interaction to opening a conversation
The researchers first required the recipient to click Preview once. They later arranged automatic Preview on navigation, reproducing the one-link path in a separate account. The proof relied on a race between graph initialization and Preview messaging, handled in their test. The finding is not evidence that ordinary shared conversations were compromised or that attackers exploited the chain outside the research accounts.
Reported remediation and lessons for application developers
Parameter's timeline places disclosure on October 18, OpenAI reproduction and P1 reclassification on October 21, partial frontend and CSP mitigation on October 22–23, and confirmation of both web frontends rejecting the reported messages on October 26. The researchers say OpenAI paid a $5,000 bounty. Independently, Simon Willison's October 31 analysis explains why MathLive's cross-frame listener and a permissive script source made the boundary porous. Builders should validate both event.origin and event.source, use structured message schemas rather than HTML settings, avoid unsandboxed srcdoc descendants, and treat CSP as a second line of defence. The precise patch implementation and any additional related exposure remain undisclosed.