How the ChatGPT account takeover worked
The ChatGPT account takeover risk came from a public share link, not from a malicious app or a request to paste code. Parameter Labs reported that an attacker could combine a malicious HTML preview with an interactive graph in one shared conversation. When a victim opened the link, the preview used a message channel between page components that lacked adequate sender validation, eventually leading to code execution in the chatgpt.com context.
From sandbox escape to private-chat access
The preview itself was placed in a restricted frame on a separate web origin and was not supposed to read the parent page. The gap appeared when a component such as MathLive accepted insufficiently validated cross-frame messages and inserted their HTML into the real page. The researchers then used an externally allowed script path to get around the content security policy. The resulting code could use the victim’s existing signed-in session to enumerate conversations, request private conversation content, and send selected data to an external server.
What the fix means—and what remains important
The report says OpenAI reproduced both code execution and private-chat access, then deployed a fix on October 26, 2026, classifying the issue as P1. The central lesson is broader than blocking one external script: every cross-frame message needs sender validation, inserted content must be constrained, and untrusted previews should not be able to create unsandboxed documents in the main page. Users should still treat unfamiliar ChatGPT share links cautiously and review unusual account activity.
The public material demonstrates a researcher-controlled chain that could read and exfiltrate selected private conversation data. It does not provide evidence that real attackers exploited the flaw, nor does it describe the full audit scope for every related component after the fix. The main open question is whether other combinations of previews, message passing, and third-party libraries could create similar trust-boundary gaps elsewhere.