ChatGPT Sandbox Flaw Exposed Private Chats Through Share Links

Parameter researchers discovered a vulnerability where malicious ChatGPT share links could execute arbitrary code within a victim’s authenticated session. Opening the link and clicking the Preview button—or in a later variant, simply opening the link—was enough to trigger the exploit. The attacker code ran with full access to the victim’s ChatGPT APIs, allowing it to list recent conversations, access private unpublished chats, and send their contents to attacker-controlled servers. The vulnerability carried a P1 severity rating and was fixed eight days after being reported through OpenAI’s bug bounty program.

The attack exploited a chain of three design weaknesses. ChatGPT’s Preview feature isolates HTML content in a sandboxed frame, but a shared chat containing an interactive graph loaded the MathLive math library into the main page. This library’s message listener failed to validate the source of cross-frame communications and accepted raw HTML in keyboard-layout data. An attacker could leverage this to create an unsandboxed frame bearing the chatgpt.com domain, then inject code from YouTube—which the site’s content security policy explicitly allows—to execute arbitrary actions within the victim’s account.

OpenAI patched the vulnerability by blocking the problematic message types across both versions of ChatGPT’s web interface. No user action is required, and Parameter’s controlled testing found no real-world exploitation. The researchers received a $5,000 bounty for their disclosure.