ChatGPT share-link flaw let attackers take over accounts through a MathLive and YouTube exploit chain; OpenAI fixed it October 26

• Affected surface: ChatGPT's web app, specifically conversations that contain an interactive graph (which loads MathLive) and an HTML Preview, the sandboxed custom-HTML feature formerly called Canvas (OpenAI Help; Willison).
• What the attacker needed: the ability to create and publish a share. The victim only had to be signed in and open the /share/<id> link.
• What the attacker gained: the payload could list recent conversations, fetch unshared ones, and call any frontend API as the victim (Parameter).
• No AI model was involved. This was a flaw in the product's web code, not in the model.

The chain had five links (Parameter):

1. Graph component. The graph loaded MathLive, which installed a postMessage listener on the top-level page. That listener checked neither event.origin nor event.source.
2. HTML in settings. A mathlive#virtual-keyboard-message / update-setting message could carry raw HTML in its layouts field.
3. Fake sanitizer. MathLive's createHTML() wrapper marked strings as trusted without cleaning them, and the result went into innerHTML.
4. Iframe escape. The injected HTML created an <iframe srcdoc> with no sandbox attribute. Because the main page created it, the frame inherited the https://chatgpt.com origin.
5. CSP bypass. ChatGPT's CSP allowed scripts from YouTube. YouTube's oEmbed JSONP callback parameter echoed attacker code back before validation, so the code ran.

Data left through a plain image request. Parameter published a proof-of-concept payload outline but no public reproduction harness.

• Attack chain, timeline, P1 rating, $5,000 payout: all come from the researcher's own writeup (Parameter). OpenAI has published no statement or advisory.
• Independent corroboration: none available. Ostorlab says it summarized Parameter's research rather than reproducing it (Ostorlab). Willison's post is commentary on the writeup (Willison).
• No exploitation in the wild: this rests on Parameter's account, as relayed by Ostorlab, that the bug was only shown in controlled testing (Ostorlab).

• The exploit uses familiar web-security mistakes: unchecked postMessage listeners, innerHTML sinks, and JSONP endpoints on CSP-allowlisted domains. Hacker News commenters made the same point (HN).
• Willison frames it as a failure of the "artifacts" pattern. In that pattern, untrusted HTML in a sandboxed frame must never be able to reach the host page's APIs (Willison).
• In March 2025 OpenAI raised its top bounty for "exceptional and differentiated" critical findings from $20,000 to $100,000 (BleepingComputer).

• Bounty size is contested. Willison called $5,000 "a bit cheap" for a bug this serious (Willison). Hacker News commenters argued that low payouts push researchers toward exploit markets, while others defended disclosing ethically anyway (HN).
• MathLive's upstream status is unclear. The writeup names no fixed MathLive release, and Ostorlab notes that npm and GitHub disagree on which version is the latest (Ostorlab).
• Writeup clarity. Some HN commenters said the post read as AI-generated and made the chain harder to follow (HN).

• Audit MathLive integrations directly. Teams embedding MathLive shouldn't assume an upgrade fixes this; Ostorlab advises checking your own integration (Ostorlab).
• Apply Parameter's four rules (Parameter):
• check both sender origin and window on every message receiver;
• never pass raw HTML in cross-window settings;
• keep dynamically created documents sandboxed;
• treat CSP as a backup, not the main barrier.
• Review CSP allowlists. Any allowed domain with a JSONP endpoint, YouTube included, can serve attacker-controlled script.
• Treat share links as an attack surface. Products that render user-generated code previews, which most AI chat apps now do, inherit the risk from every third-party library on the host page.