Security researchers at Parameter found a flaw that lets code run inside any logged‑in web session that opens a shared conversation link (The Hacker News). They reported the issue through OpenAI's bug bounty program on October 18, 2026. OpenAI reproduced the bug, upgraded its severity from P2 to P1, and deployed a fix on October 26, 2026 (Parameter).
The attack chained ChatGPT's HTML Preview tool with an interactive graph feature. When a shared chat displayed an interactive graph, it loaded the MathLive math library onto the main chatgpt.com page. MathLive left an event listener on the page that did not verify the origin of incoming frame messages.
Because the MathLive listener accepted unchecked cross‑frame messages containing raw HTML, malicious HTML from the isolated Preview sandbox could reach the main page. The injected HTML created a secondary frame on the chatgpt.com domain, and ChatGPT's content security policy allowed script execution from YouTube, letting the payload pull executable code via YouTube to complete the chain.
Once running, the script inherited the victim's full web session permissions on chatgpt.com. In controlled tests with separate research accounts, Parameter showed the payload could list recent chats, open unshared private conversations, and send that data to an external server. The script called ChatGPT's authenticated internal APIs directly.
Exploiting the flaw required no app installation, workspace joins, or user‑pasted code. Initially, a victim had to click the Preview button after opening the link; Parameter later demonstrated a variant where the Preview loaded automatically, needing only the URL to be opened.
Parameter confirmed the testing was done entirely in a controlled environment using research‑owned accounts, and no real‑world exploitation has been observed. OpenAI patched the vulnerability eight days after receiving the report.
This vulnerability underscores the hidden risks of layering multiple rich web features in a single generative AI session. Even when components such as HTML sandboxes appear isolated, secondary libraries like MathLive can create subtle communication gaps. OpenAI's rapid response reflects the seriousness of domain‑level account execution, where browser security policies can be bypassed by trusted script origins such as YouTube. Security teams overseeing AI platforms should rigorously audit cross‑origin communication rules whenever new interactive rendering capabilities are added to user sessions.
Spotted an error? See our corrections policy or email editorial@lordofclaude.com.
Discussion & Comments (0)
Join the conversation