Security researchers at Parameter AI have disclosed a vulnerability they say could have turned an ordinary ChatGPT shared-conversation link into a route for accessing a visitor's private account data. OpenAI fixed the issue on October 26, according to the researchers, who said the company classified their report at its highest P1 severity level.
The reported attack combined several otherwise separate web features. ChatGPT's HTML Preview runs untrusted code in an isolated frame, while an interactive graph loaded the MathLive library into the main ChatGPT page. Parameter AI found that a MathLive message listener did not adequately verify the origin of certain cross-frame messages. That gap allowed the isolated preview to influence content rendered in the trusted page.
The researchers said they could make MathLive create an unsandboxed `srcdoc` frame carrying attacker-selected HTML. ChatGPT's content-security policy still blocked ordinary inline scripts, but the team found a second route through a YouTube endpoint already permitted by that policy. In their account, this chain ultimately allowed JavaScript to execute with the `chatgpt.com` origin rather than the preview site's restricted identity.
That distinction was critical. Code running under ChatGPT's own origin could call authenticated application interfaces as the user who opened the link. In testing, Parameter AI said it enumerated a victim account's conversation list, retrieved material from a private conversation that had never been shared with the attacker, and transmitted information to an external server.
The final delivery method used a public `/share/` conversation containing both the graph and the malicious preview material. The researchers said the most stable version required the visitor to open the shared conversation and press ChatGPT's normal Preview button. It did not require installing an application, joining a project, pasting code, or using browser developer tools.
The disclosure is a reminder that browser isolation depends on the complete interaction between components, not only on the sandbox around the most obviously untrusted element. A preview can remain unable to inspect its parent directly while still reaching a permissive message listener installed by another feature. Likewise, a content-security policy can be weakened when a trusted external script source offers behavior that can be repurposed.
Parameter AI's report describes controlled research rather than evidence of exploitation in the wild. With the flaw patched, the technical account is most useful as a case study for developers: validate message origins and sender windows, avoid injecting untrusted HTML, sandbox dynamically created frames, and review every script source allowed by a site's security policy.
