The exploit crossed from a preview frame into the main ChatGPT page, enabling full account takeover.
OPENAI PATCHES CHATGPT ACCOUNT TAKEOVER VULNERABILITY
*OpenAI disclosed a critical P1 flaw that let attackers hijack any ChatGPT account by sending a malicious share link. The exploit bypassed sandbox and CSP, allowing full read/write access to private conversations. Fix deployed on Oct 26 2026.*
On Oct 28 2026 researchers from Parameter published a step‑by‑step account of a zero‑day that let anyone seize control of a ChatGPT session with a single click. By crafting a malicious conversation and publishing it through ChatGPT’s native sharing feature, the team demonstrated that opening the share link executed attacker‑controlled JavaScript inside the victim’s authenticated chatgpt.com session. The code could read private chats, exfiltrate data, and issue API calls as the logged‑in user. No installation, no developer tools, no extra permissions were required—just the act of opening the link. OpenAI classified the report as P1 severity and issued a fix on Oct 26 2026, but the episode raises serious questions about sandbox design in AI‑driven web apps.
How the exploit worked
The attack chained two unrelated features: the HTML Preview and an interactive graph that loads MathLive. The Preview runs in a restricted iframe, but MathLive’s listener accepted postMessage calls from any origin without verification. The attacker sent a message that replaced the virtual keyboard layout with HTML containing an iframe using srcdoc. Because the iframe was inserted without a sandbox attribute, it inherited the chatgpt.com origin and could run scripts in the main page context. CSP blocked inline scripts but allowed loading from YouTube, which the attackers leveraged via a JSONP endpoint to execute code. The resulting payload enumerated the victim’s conversation list, retrieved private content, and sent it to an external server, effectively taking over the account.
Can similar features be abused elsewhere?
The chain shows how seemingly harmless cross‑frame communication can become a bridge for privilege escalation. Any web app that mixes sandboxed previews with third‑party widgets that accept unchecked messages is vulnerable. The MathLive listener’s lack of origin validation turned a benign postMessage into a conduit for HTML injection. When combined with an iframe that inherits the parent’s identity, the attack surface expands dramatically. Developers must enforce strict origin checks and sandbox attributes on dynamically created frames. The incident underscores that security reviews need to consider interactions between independent features, not just each feature in isolation.
OpenAI’s response and remediation
OpenAI responded on Oct 26 2026, assigning the report P1 severity and deploying a patch that closes the postMessage loophole and adds sandboxing to dynamically created iframes. The fix also tightens MathLive’s message handling to require verified origins before accepting layout updates. OpenAI issued a security advisory warning users to avoid opening unknown share links until the patch was live. No evidence of widespread abuse was reported, but the rapid disclosure and fix demonstrate a functional incident response pipeline. The company has pledged to audit other preview‑related components for similar cross‑origin weaknesses.
Implications for AI platform security
This breach highlights that AI‑enhanced interfaces inherit classic web security challenges and amplify them with rich interactive components. As AI platforms embed more live previews, graphs, and third‑party libraries, the attack surface grows. The exploit proves that a single unchecked message can cascade into full account takeover, compromising user privacy and trust. Vendors must adopt defense‑in‑depth: strict CSP, origin‑verified messaging, and sandboxed iframes with explicit restrictions. Regulators may soon scrutinize AI services for such systemic flaws, and enterprises will need to reassess reliance on shared AI tools for confidential data.
Frequently asked questions
What did the ChatGPT vulnerability allow attackers to do?
It let attackers take over any ChatGPT account, enumerate conversation lists, retrieve private conversation content, and send that data to an external server while acting as the victim via authenticated APIs.
How was the exploit triggered?
By sending a victim a link to a public ChatGPT share that contained malicious HTML/JavaScript; opening the link executed code in the victim’s signed‑in session.
When did OpenAI fix the issue?
OpenAI fixed the issue on October 26 2026 and classified the report as P1 severity.
OpenAI’s swift patch closes the immediate breach, but the episode serves as a cautionary tale for the broader AI ecosystem. As developers race to add richer, interactive features, they must remember that every new widget is a potential vector. Future safeguards will hinge on rigorous cross‑origin validation and sandbox enforcement, lest attackers find the next hidden bridge between a harmless preview and a full‑privilege compromise.
Sources: [Hacker News – We Took over ChatGPT Accounts (https://www.parameter.ai/labs/we-found-a-gap-at-openai)]