A malicious ChatGPT shared link can run attacker code in a logged-in session and read private chats

Researchers at the security company Parameter demonstrated that a malicious ChatGPT shared link can run attacker code in a victim's logged-in session and read private chats; the researchers reported it on October 18 through OpenAI's bug bounty program, and OpenAI fixed it eight days later and rated it the highest severity, P1. The victim only needs to open the link and click Preview once (in a later attack version, opening the link triggers it automatically), and the attack code runs with the same permissions as the ChatGPT site, can call logged-in APIs to list recent conversations, open private chats that were never shared, and send the contents to a server controlled by the researchers. The vulnerability stems from three overlapping design issues, among which a listener left on the main page by the MathLive math library does not verify the message origin and allows raw HTML to be carried, enabling code inside the Preview sandbox to create a frame that inherits the chatgpt.com identity, and then execute code via a CSP-allowed YouTube script.