A critical security disclosure has exposed a vulnerability in OpenAI’s ChatGPT web interface that allowed attackers to completely hijack logged-in accounts and extract private conversation records through an ordinary shared chat link.
Published by security firm Parameter Labs on October 28, 2026, in a technical report titled "Do the Math: How We Took Over ChatGPT Accounts," the findings detail a multi-stage exploit chain that bypassed the application's browser sandbox and Content Security Policy (CSP). By simply convincing a user to open a link to a shared ChatGPT dialogue, an attacker could silently execute arbitrary JavaScript inside the victim's authenticated session on chatgpt.com. The malicious code then invoked OpenAI’s internal APIs to enumerate private conversations, pull full transcripts from unshared chats, and exfiltrate the data to a remote command server—all without requiring the victim to enter credentials, paste code, or click interactive prompts.
Parameter Labs reported the flaw to OpenAI on October 18, 2026. OpenAI triaged the issue, raised its classification to P1—the company’s highest internal severity rating—and confirmed a production fix across both of its web frontends on October 26. The AI giant awarded the researchers a $5,000 bounty. Three days later, on October 31, the open-source mathematics library MathLive, whose code sat at the center of the sandbox escape, pushed version 0.111.2 to fix its unvalidated messaging defaults.
The disclosure disrupts the prevailing consensus surrounding generative AI security. Over the past several years, enterprise security teams and AI vendors have poured immense engineering resources into neutralizing prompt injection, model jailbreaks, and indirect prompt manipulation. Yet this vulnerability bypassed the model’s linguistic guardrails entirely. It relied on classic web application security flaws—unvalidated cross-window messaging, an unsafe DOM sink, and a Content Security Policy misconfiguration—chained through ChatGPT’s dynamic user interface components.
As companies integrate shared AI workspaces, interactive widgets, and rich code-execution canvas tools into their core business workflows, the Parameter Labs exploit reveals how the client-side attack surface of AI platforms has outpaced the security controls designed to govern them.
Inside the Chain: How a Shared Link Hijacked Logged-In Sessions
The exploit discovered by Parameter Labs was not a single programming blunder, but rather a sequence of compounding architectural oversights across three distinct layers of ChatGPT’s frontend architecture:
[Attacker creates shared chat with Graph + Preview]
│
▼
[Victim opens public share link on chatgpt.com]
│
▼
[Sandboxed HTML Preview iframe sends cross-frame postMessage]
│
▼
[MathLive in parent context executes innerHTML sink without origin check]
│
▼
[Unsandboxed iframe injected via srcdoc inherits chatgpt.com origin]
│
▼
[YouTube oEmbed JSONP endpoint bypasses Content Security Policy]
│
▼
[Full JavaScript execution under victim's active session]
│
▼
[Private conversation APIs queried & sensitive data exfiltrated]1. The Delivery Vector: weaponizing ChatGPT's Native Sharing
ChatGPT permits users to generate public links to share conversations with colleagues or friends. When opened, these links render the dialogue within the recipient’s existing browser session. If the recipient is logged in, the page loads beneath their authenticated profile, maintaining their active access tokens and workspace configurations in memory.
The researchers established that this sharing mechanism could carry an interactive mathematical graph alongside an HTML Preview element (the feature previously known as Canvas or Artifacts). Under normal circumstances, each of these features operated within its own intended boundaries. Together, they established the conditions necessary to bridge untrusted code into the trusted parent page.
2. The Sandbox Escape via MathLive
To allow users to view dynamic web pages, games, or charts rendered by the AI, ChatGPT displays code inside an HTML Preview hosted in an