Researchers at security firm Parameter found that a specially crafted shared ChatGPT link could potentially run code in a victim’s logged-in session and access private conversations.

The exploit combined ChatGPT’s Preview feature with an interactive graph that loaded MathLive. MathLive’s message listener accepted input from any frame, including attacker-controlled HTML, allowing the untrusted Preview to cross into the trusted ChatGPT page and create a frame treated as part of chatgpt.com; a YouTube endpoint helped bypass script restrictions.

The attack could start when a user opened the shared link and used Preview, though Parameter also demonstrated a version that triggered Preview automatically. In a controlled demonstration, the researchers used authenticated ChatGPT APIs to list recent chats, retrieve a private conversation that had never been shared with them, and send selected data to an external server; they said the access could enable other actions as the victim.

Parameter confirmed the issue in production code on October 13, 2026, and reported it to OpenAI through its bug bounty program on October 18. OpenAI reproduced the vulnerability, raised its severity from P2 to P1, and deployed fixes to two versions of the ChatGPT web frontend by October 26; both versions then rejected the messages used in the exploit.

Parameter published its research on October 28, after the fix, and received a $5,000 bounty from OpenAI. The researchers reported no real-world exploitation, and users do not need to take any remediation steps, though the article advises caution with unfamiliar shared AI conversations.

Parameter said blocking YouTube alone would not address the underlying HTML-injection weakness.