TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researchers at Parameter reported that a malicious ChatGPT shared conversation could run JavaScript in the signed-in session of anyone who opened it. They said the exploit could access private conversations and send their contents to an external server; OpenAI fixed the issue on October 26 and classified the report as P1.
Security researchers at Parameter say they found a way for a malicious ChatGPT shared conversation to run JavaScript inside the signed-in session of anyone who opened it, potentially exposing private chats and allowing actions through that account. OpenAI fixed the vulnerability on October 26, 2026, and classified the report as P1, according to Parameter.
Parameter’s report describes an attack that began with an attacker creating a conversation containing a graph and an HTML Preview, then publishing it through ChatGPT’s ordinary sharing feature. The researchers said the victim only had to open the shared link; no app installation, project membership, code entry or developer tools were required.
ChatGPT’s Preview ran in a restricted frame on a separate web address, which was intended to prevent its code from reading the main ChatGPT page. Parameter said a graph in the same conversation loaded MathLive, whose message listener operated in the main page. The researchers report that the listener accepted messages without checking the sender’s origin, allowing Preview content to alter the virtual keyboard layout and cause HTML to be inserted into the ChatGPT page.
According to Parameter, the injected HTML created an unsandboxed frame that ran with ChatGPT’s web identity. The researchers say they then worked around the site’s Content Security Policy using a YouTube oEmbed JSONP behavior. Parameter reports that the resulting code could call authenticated ChatGPT APIs, enumerate conversations, retrieve a private conversation and send its content to an external server. The supplied source ends during its technical walkthrough, so it does not provide the full remaining exploit details.
The report matters because a shared conversation is commonly treated as content to view, rather than as a route to account-level access. In the chain described by Parameter, opening a link was enough to expose data available to the victim’s signed-in session. That could make a familiar sharing workflow a security risk when a malicious conversation is involved.
Parameter says the exploit could do more than change what appeared on screen: it could reach authenticated APIs and retrieve private conversation content. This distinction is important for users and organizations that keep sensitive material in ChatGPT. The report does not establish that attackers exploited the flaw in the wild or that any actual users’ data was taken; it documents what the researchers say they demonstrated.
The incident also illustrates how interactions between separately developed features can undermine security boundaries. The Preview frame was restricted, but the researchers say a message listener associated with a graph feature provided a route for untrusted content to affect the main page. OpenAI’s reported P1 classification and October 26 fix indicate the company treated the disclosure as a high-priority issue, though the source gives no further detail on its rating criteria.
Products Worth Considering
eufy Security Video Doorbell E340 Kit with Chime, 2K Resolution and 8GB Local Storage
eufy Security SoloCam E42 4-Camera Kit, 4K Solar Security Cameras with HomeBase 3
eufy Security E30 4K Indoor Camera, 2-Pack
As an affiliate, we earn on qualifying purchases.
How the Features Connected
ChatGPT’s HTML Preview can render code blocks as small web pages. Parameter says the Preview ran on a separate origin, meaning the browser should prevent it from directly reading the signed-in page’s document. The researchers’ account centers on a separate browser feature: frames can exchange messages using postMessage, but receivers need to validate where those messages came from.
In Parameter’s description, MathLive supplied a listener for messages about its virtual keyboard. The listener accepted a layout update and rendered supplied markup as HTML in the main page. A helper that appeared to mark the markup as trusted did not sanitize it, the researchers said. Because HTML inserted through innerHTML does not by itself execute script tags, Parameter describes using an unsandboxed iframe and an allowed YouTube script source to continue the chain.
The report says OpenAI corrected the issue on October 26, 2026. The material provided does not give the disclosure date, the exact changes in the fix, or whether the vulnerable behavior involved a third-party component that OpenAI modified, updated or removed.
““The victim did not need to install an App, join a Project, paste code, or open developer tools. Opening the shared link was the only required action.””
— Parameter researchers
What the Report Leaves Open
The supplied material does not say whether the vulnerability was exploited by anyone beyond Parameter’s testing, whether any accounts or data were compromised, or how many users may have been exposed before the fix. It also does not include a statement from OpenAI confirming the technical findings or explaining the P1 classification.
Parameter reports that OpenAI fixed the issue on October 26, but the source does not specify the precise remediation, whether users needed to take any action, or whether the fix was deployed to all users immediately. The technical walkthrough provided is incomplete, ending as it begins to explain the YouTube JSONP step, so some implementation details cannot be assessed from this material alone.
After the October 26 Fix
OpenAI’s reported fix is the immediate status update. The source does not announce a further investigation, public advisory, user notification or follow-up report, so no additional milestone is confirmed. Readers who opened a suspicious ChatGPT share before October 26 may want to consult OpenAI’s current security guidance or contact the company if they notice unusual account activity; the supplied report does not say that a password reset or other action is required.
Any further assessment depends on information not included in Parameter’s account: OpenAI’s description of the patch, confirmation of the affected versions and exposure period, and whether there is evidence of exploitation outside the researchers’ tests. Until that is available, the reported capability should be distinguished from confirmed real-world account compromise.
Key Questions
What did the ChatGPT vulnerability allow?
Parameter says a malicious shared conversation could run code in a viewer’s signed-in session, call authenticated ChatGPT APIs and retrieve private conversation content. The researchers also said their test code sent conversation data to an external server.
Did a victim have to install anything or enter code?
According to Parameter, no. The researchers said opening the shared conversation link was the only action required from the victim.
Has OpenAI fixed the issue?
Parameter reports that OpenAI fixed it on October 26, 2026 and classified the report as P1. The supplied material does not describe the patch or say whether users need to take any specific steps.
Is there evidence attackers used the flaw against users?
The provided report describes the researchers’ demonstrated capability but does not establish that the flaw was exploited in the wild or that user accounts or data were compromised.
Source: parameter.ai
