What happened
Parameter reported on October 18 that a crafted ChatGPT share link could execute code in a victim's signed-in session; OpenAI reproduced it, escalated from P2 to P1, and shipped a server-side fix across two ChatGPT web frontends by October 26, paying a $5,000 bounty.
Why it matters
The victim needed only to open the link and click Preview once, after which the attacker's script could read private chats that had never been shared and act on the victim's behalf — a session-hijack risk for anyone who opens shared AI links, with the fix requiring no user action.
WHO IT HITSBusinesses and teams whose staff open shared ChatGPT links face a session-hijack risk, since the attacker's script could read private conversations and call authenticated APIs on the victim's behalf; the server-side patch means users had to do nothing.
Summaries like this, every morning.
The attack did not require the victim to install anything, join a workspace, or sign in through the attacker. In the most reliable version, the victim opened the link and clicked ChatGPT's Preview button once; in a later version Parameter set the page to open Preview automatically, so clicking the link was the only step. That low bar is what made the flaw notable for anyone who routinely opens shared AI links.
The technical chain stitched together three design flaws: ChatGPT's Preview frame on a separate origin, the MathLive library listening for cross-frame messages on the main page, and YouTube already being on ChatGPT's content security policy allowlist so the final payload loaded without complaint. Parameter's report led OpenAI to reproduce both the code-execution and private-chat proof-of-concept, escalate severity from P2 to P1, and roll a fix across two versions of ChatGPT's web frontend, closing the issue on October 26.
The upstream MathLive project also released version 0.111.2, adding same-origin validation for postMessages and closing the attack vector for every app embedding the library, not just ChatGPT. The disclosure, by The Hacker News reporter Swati Khandelwal, lands amid close to two hundred items on a cybersecurity tracker over the last 90 days.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
VicOne identified 28 zero-day findings in under two days using AI-assisted research across software from Googl…
Adobe Research and UC San Diego built EditAgent, which uses an unmodified language model to pick the best edit…
In 100 sessions using the GAD-7 anxiety questionnaire, 80% of sessions scored moderate-to-severe under a suppo…
Anthropic is reportedly asking candidates how they would feel if it abandoned AI ambitions for safety and its…
OpenAI's Misalignment Reports, launched September 16, 2026, list 20 reports as of October 30
A Google-led team introduced StreamVibe, a video agent that judges when to offer help during everyday tasks; i…
