OpenAI fixes ChatGPT flaw that let share links hijack accounts
Parameter Labs showed a crafted public share could run code in a victim's signed-in session and read private chats before OpenAI patched it October 26.
In brief
- Opening a malicious public share ran attacker code as chatgpt.com in the victim's session
- The chain abused a MathLive graph keyboard, an HTML preview and a YouTube endpoint
- OpenAI classified the report P1, fixed it October 26 and paid a $5,000 bounty
A malicious ChatGPT share link could take over the account of anyone who opened it, Parameter Labs said on October 31, turning a public conversation into attacker-controlled code running in the victim's signed-in session.
Opening the link was the victim's only required action, according to Parameter Labs. No app, project or pasted code was needed, which turned a feature used to share chats into a one-click path for reading private conversations and acting on a user's behalf.
The attack chained several features that looked harmless alone. A graph in the conversation loaded MathLive, a math library whose on-screen keyboard listens for browser messages in the main ChatGPT page. ChatGPT's HTML previews feature, which turns a code block into a small working webpage, then sent a message that slipped attacker HTML into that page.
From there the code bypassed ChatGPT's content security policy, the rule set governing which scripts a page may load, by abusing a YouTube endpoint that ChatGPT already trusted. The result was JavaScript running as chatgpt.com, which could list a victim's conversations, pull content from a private chat and send it to an outside server.
OpenAI fixed the issue on October 26 and classified the report as P1, a high-severity rating, Parameter Labs said. Simon Willison wrote that OpenAI paid a $5,000 bug bounty for the report.
The disclosure adds to scrutiny of AI chat features that render untrusted content, where code meant to stay isolated inside a sandboxed frame can reach the authenticated application around it.