Mukul Goyal, a researcher at security firm Parameter, published a post on 10 28 stating that an attacker can publish a publicly shared ChatGPT conversation containing a standard interactive chart and an HTML preview. When a victim opens the share link (the most stable reproduction requires clicking the preview button once; if auto-preview is enabled, simply opening the link suffices), the attack code executes within the victim's logged-in session as chatgpt.com. It can list conversations, read private conversations that were never shared, and send them to an external server. The researcher stated that OpenAI fixed the issue on 10 26, rated it P1, and awarded a total bounty of $5000.
Confidence: Low (40) · Unverified · Event Date 2026-10-28
Reasoning
- The attack chain is composed of several individually reasonable features: the MathLive math keyboard library, loaded by the chart, listens for cross-window messages on the main page without validating the sender and allows raw HTML to be written into the page. The HTML preview in the sandbox exploits this to insert an unsandboxed iframe into the main page, then executes arbitrary scripts via the JSONP callback of the YouTube oEmbed interface, which is whitelisted in the Content Security Policy (CSP).
- After chat products add executable content such as code previews and apps, "who can the code in the sandbox communicate with" becomes a new attack surface. The researcher stated that the injected code can call all logged-in interfaces of the ChatGPT web client as the victim, not limited to reading conversations.
- The Hacker News discussion focused on the low bounty: many argued that a P1 rating with only a $5000 bounty would discourage researchers from reporting to OpenAI.
Usage
- Regular users do not need to take any action; the researcher stated the vulnerability has been fixed. Developers building web-based AI products can refer to the defensive recommendations in the article: receivers of postMessage should validate both the origin address and the window, avoid passing raw HTML in cross-window settings, keep dynamically created documents sandboxed, and treat CSP only as a last line of defense. The original article is at parameter.ai/labs.
Risk
- Currently, only the researcher's own article exists; OpenAI has not issued a public statement. The fix date, P1 rating, and bounty amount all come from the timeline provided by the researcher.
- The article does not state whether the vulnerability was exploited by others before the fix, and OpenAI has not disclosed this either.