# A shared ChatGPT link could read private conversations — a fixed MathLive sandbox escape shows why cross-frame trust matters Parameter Labs demonstrated that opening a malicious shared ChatGPT conversation could execute code in a signed-in user's session and retrieve unrelated private chats. The researchers say OpenAI fixed the P1 flaw on October 26; no exploitation outside controlled tests is established. A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content. - Status: Active - Published: 2026-11-01T18:41:56+13:00 - Updated: 2026-11-01T18:41:56+13:00 - Categories: Artificial Intelligence, Web Development, AI Coding, Developer Tools - Tags: account takeover, AI security, browser security, ChatGPT, OpenAI - Canonical HTML: https://beyondthe.news/dossiers/chatgpt-shared-link-mathlive-html-preview-account-takeover-parameter-2026 ## What changed In a technical disclosure published October 28, 2026, Parameter Labs described a vulnerability chain in ChatGPT's public conversation sharing feature. A crafted shared conversation combined a normal interactive graph, which loaded MathLive into the main page, with an HTML Preview in a sandboxed frame. The MathLive virtual-keyboard message receiver accepted a state-changing message from the Preview without verifying its sender, then rendered attacker-supplied markup into the main ChatGPT page. That markup created an unsandboxed same-origin document; a script allowed by the page's Content Security Policy completed the chain. In researcher-controlled tests, code ran as chatgpt.com and retrieved content from an unrelated private conversation. Parameter says it reported the issue October 18; OpenAI reproduced it, rated it P1 and confirmed both web frontend versions fixed by October 26. No public OpenAI incident report or evidence of exploitation in the wild was established. ## Why it matters Many builders now let AI agents, customers and collaborators share generated HTML, dashboards or previews inside authenticated applications. Putting untrusted HTML in a sandbox is necessary but not sufficient when a privileged component in the surrounding page accepts messages from any frame and turns them into markup. This case shows how an apparently isolated preview can borrow the authenticated site's authority without breaking the browser's same-origin policy directly. The operational lesson is to authenticate cross-window messages, avoid rendering raw HTML from message payloads, and keep any derived documents sandboxed. For ChatGPT users, the disclosed exploit is reported fixed server-side; there is no verified need for a user-side patch or password reset based solely on this report. ## The sandbox was intact; the trusted listener was not The HTML Preview could not initially read the parent page. A separate graph feature loaded MathLive, whose virtual-keyboard controller listened for cross-frame messages and accepted a layout update without checking the sender's origin and window. The layout allowed HTML, which was inserted into the privileged document. This is the trust-boundary failure: a component in the trusted page promoted untrusted frame data into page content. ## A chain of ordinary browser features reached the signed-in session The injected markup could create a new iframe without sandbox restrictions and inherit the main site's origin. The page's CSP blocked inline scripts, but an allowed third-party script endpoint was usable as a code-execution gadget. Parameter's controlled proof then called authenticated conversation APIs, listed recent conversations, read a private conversation never shared with the attacker and sent a small selected value to a researcher-controlled endpoint. The team argues the resulting access could have supported other authenticated actions, but those broader actions were not demonstrated in the published proof. ## The share link reduced victim interaction to opening a conversation The researchers first required the recipient to click Preview once. They later arranged automatic Preview on navigation, reproducing the one-link path in a separate account. The proof relied on a race between graph initialization and Preview messaging, handled in their test. The finding is not evidence that ordinary shared conversations were compromised or that attackers exploited the chain outside the research accounts. ## Reported remediation and lessons for application developers Parameter's timeline places disclosure on October 18, OpenAI reproduction and P1 reclassification on October 21, partial frontend and CSP mitigation on October 22–23, and confirmation of both web frontends rejecting the reported messages on October 26. The researchers say OpenAI paid a $5,000 bounty. Independently, Simon Willison's October 31 analysis explains why MathLive's cross-frame listener and a permissive script source made the boundary porous. Builders should validate both event.origin and event.source, use structured message schemas rather than HTML settings, avoid unsandboxed srcdoc descendants, and treat CSP as a second line of defence. The precise patch implementation and any additional related exposure remain undisclosed. ## Key details - Parameter Labs published the technical disclosure on October 28, 2026, after reporting the flaw October 18. - The crafted carrier was an ordinary public ChatGPT share link containing a graph and an HTML Preview. - The Preview's sandbox was not itself bypassed by direct DOM access; a MathLive postMessage listener accepted untrusted settings and rendered raw markup in the parent page. - The researchers demonstrated authenticated access to a private conversation unrelated to the shared link, including limited data exfiltration in controlled accounts. - OpenAI reportedly reproduced the issue October 21, raised it from P2 to P1, and confirmed a fix across two frontend variants October 26. - The reported $5,000 bounty and P1 classification come from the researchers' account; no public OpenAI advisory was independently located. - No real-world exploitation, affected-user count or confirmed account changes outside the proof were established. ## Builder takeaways - Authenticate both the origin and window identity of state-changing postMessage senders; do not accept messages merely because they use a recognised type. - Keep untrusted HTML out of privileged UI configuration paths and preserve sandboxing when creating nested documents. - Review third-party script allowlists for code-serving endpoints; CSP cannot compensate for arbitrary HTML injected into a trusted origin. - Test combinations of independently safe features, particularly share links, embeds, previews and authentication. - Treat the flaw as reported fixed server-side; do not imply ChatGPT users must reset credentials without evidence of a separate compromise. ## What to watch - Whether OpenAI publishes a direct advisory or more precise scope and remediation details. - Any credible report of exploitation beyond Parameter's controlled test accounts. - MathLive or downstream library guidance on secure cross-frame virtual-keyboard messaging. - Whether other authenticated web apps embed similar untrusted previews alongside privileged message listeners. ## Uncertainties - The patch details and exact affected deployment/version window are not publicly established by an OpenAI advisory in the inspected sources. - Parameter demonstrated private-chat reads and limited exfiltration, not every other potential account action it discusses. - No evidence was found of in-the-wild exploitation or a known number of affected users. - Independent analysis corroborates the mechanism but did not independently reproduce the complete exploit after the reported fix. ## Sources - [Do the Math: How We Took Over ChatGPT Accounts](https://www.parameter.ai/labs/we-found-a-gap-at-openai) — Parameter Labs · primary security research · 2026-10-28T00:00:00+13:00. Original proof, controlled data access, remediation timeline and limitations. - [How We Took Over ChatGPT Accounts](https://simonwillison.net/2026/Oct/31/how-we-took-over-chatgpt-accounts/) — Simon Willison · independent technical analysis · 2026-10-31T00:00:00+13:00. Independent explanation of the MathLive cross-frame and CSP chain; not a separate reproduction. - [One Click Into Someone Else’s ChatGPT: Cross-Frame Messaging Flaws](https://labs.cloudsecurityalliance.org/research/csa-research-note-chatgpt-share-link-session-hijack-20261031/) — Cloud Security Alliance AI Safety Initiative · independent security research note · 2026-10-31T00:00:00+13:00. Third-party security analysis and defensive lessons, based on disclosed research.