Opening a ChatGPT Share Link Was Enough to Steal Private Chats: OpenAI Paid $5,000

AI 요약

• Opening an attacker's ChatGPT share link ran code as the victim and read their private chats.
• OpenAI rated it P1 and patched it October 26. MathLive fixed the root cause five days later.
• Apps still on MathLive 0.111.1 or older have origin checking off by default.

Opening a ChatGPT share link built by an attacker was enough to run that attacker's code inside the victim's logged-in session and send private conversations out of it. No install, no pasted snippet. Mukul Goyal of the security firm Parameter published the chain in a report on October 28. OpenAI classified the flaw as P1, its top severity, finished the fix on October 26, and paid a $5,000 bounty.

No real-world exploitation has been reported. The testing ran between accounts the researchers controlled, and the Parameter report says nothing about abuse in the wild. We found no separate advisory from OpenAI.

The sandbox held. The math library next to it did not

ChatGPT's preview feature renders HTML from a conversation as a small web page. Because arbitrary code can run there, it is confined to a restricted frame served from a different origin than ChatGPT itself. Parameter states that this isolation worked as designed: code inside the preview could not read the ChatGPT page around it.

The gap was an interactive chart sitting in the same conversation. When that chart loads MathLive, a math input library, MathLive installs a message listener on the main ChatGPT page. The browser's postMessage is how isolated frames pass notes to each other, which only stays safe if the receiving side checks who sent the note. The MathLive listener did not check the sender.

The last gate was CSP, the allowlist that decides which origins a page may execute scripts from. ChatGPT blocked inline scripts but allowed YouTube. YouTube's oEmbed endpoint echoed an invalid callback value back verbatim, ahead of its error response, and the researchers loaded that response as a script. Parameter wrote that this bypass was only the final step, not the root cause.

How many clicks it takes depends on how the test is set up. The most reliably reproduced path was opening the link and then pressing the preview button once. Marking an HTML block as previewable makes it open automatically, which leaves opening the link as the only action required. The researchers reproduced this path three times from separate accounts, with the code executing roughly 4.5 seconds later.

What was demonstrated stops at reading private chats

Three things were actually shown:

• reading the victim's recent conversation list
• reading the contents of a private conversation never shared with the attacker
• sending part of that response to the researchers' server

The amount sent out was deliberately kept small. Since the injected code could read the full response, the exfiltration ceiling is not that small value.

Account takeover is the researchers' characterization. The report reasons that because the code calls ChatGPT's internal API with the victim's privileges, anything the victim can do on the web is possible. Their diagram also lists file reads and account changes, but there is no record of either being demonstrated.

The argument that $5,000 is too low

Several comments in the Hacker News thread (284 points, 139 comments) called the payout low. OpenAI raised its maximum bounty from $20,000 to $100,000 in March 2025. This $5,000 is 5% of that ceiling. Hacktron's chain, which in September reached the ChatGPT accounts of OpenAI employees, drew $6,500.

The $100,000 figure is a cap for "exceptional and differentiated" findings, not a P1 base rate. We could not confirm the current P1 payout band. The initial triage was P2, and it moved to P1 on October 21, the day OpenAI reproduced it.

MathLive stayed open for five days after OpenAI closed its side

ChatGPT was fixed, but MathLive is separate open source. Checking the repository directly: the patch that changed the default landed five days after OpenAI's fix.

The commit changed the default message-origin check from 'none' to 'same-origin'. Earlier releases shipped with that check turned off. According to the changelog, another window can now only pick a built-in layout and can no longer pass custom HTML, and that holds even with validation disabled.

MathLive draws 421,823 weekly npm downloads (October 23 to 29). There is no security advisory announcing the change; the newest entry in that list is dated October 9. Neither the commit nor the changelog mentions ChatGPT or Parameter, so whether this report triggered the fix is unconfirmed. With no advisory, automated vulnerability alerts may never fire.

Running an older version is not immediately dangerous on its own. Older versions arm the listener the moment they load on a top-level page, so the same path opens when an untrusted iframe sits on that same page. Reaching code execution also requires getting past that application's own CSP.

If you run an app that renders LLM-generated HTML on screen, the structure here is yours too. However well the preview is sandboxed, the isolation stops mattering once a library on the outer page accepts the note it sends. Start with npm ls mathlive to check the version this week, then walk the top-level page's message listeners one at a time and confirm each checks both event.origin and event.source. That pair is also the first lesson Parameter drew from the chain.