$5,000 — the total bug bounty OpenAI paid for a share-link flaw that, in a controlled test, let researchers list a logged-in user's private ChatGPT conversations and read one that had never been shared.
A $5,000 bounty, an Oct. 18 report, and an eight‑day fix
Researchers at the security firm Parameter reported the flaw through OpenAI's bug bounty program on October 18. OpenAI reproduced the issue, raised its severity from P2 to P1 (its most serious category), and rolled a fix across two versions of ChatGPT's web frontend eight days later. By October 26 both frontend versions rejected the messages the attack relied on. Parameter published its detailed writeup on October 28, after the fix, and OpenAI paid a total of $5,000 for the report.
How a shared ChatGPT conversation delivered active code
The attack started from an ordinary, publicly shareable ChatGPT conversation. That shared link could be delivered like any real shared chat — by email, a chat message, a support ticket, or a social post — and the victim did not have to install anything, join a workspace, or sign in through the attacker. In the most reliable proof-of-concept, the visitor opened the link and clicked ChatGPT's Preview button once; in a later version, Parameter set the page to open Preview automatically so merely opening the link was sufficient.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogHow the Preview feature and MathLive combined to break the sandbox
Parameter mapped a specific chain of features. ChatGPT can take a block of HTML in a chat and turn it into a small web page via a feature called Preview. That preview runs in a locked-down frame on a separate web address so it should not be able to read the main ChatGPT page around it. Separately, the same conversation contained an interactive graph whose drawing code loaded a math library called MathLive into the main ChatGPT page. Loading MathLive left a listener in the main page that accepted messages about its on-screen keyboard.
Messages passed between browser frames are safe only if the receiver checks who sent them. Parameter found that MathLive's listener accepted a keyboard message from any sender and that the message was allowed to carry raw HTML as keyboard-layout data. The Preview frame could therefore send attacker HTML across the boundary into the trusted main page. That HTML built a new frame that the browser treated as part of chatgpt.com; a script loaded from YouTube then supplied the code that ran inside it. ChatGPT's content security policy blocked inline code but allowed scripts from YouTube, which is why that final step worked. Parameter emphasized that the YouTube script was a workaround, not the root cause: blocking that single source would not have prevented the Preview from pushing HTML into the main site.
What the attacker could do inside a signed‑in session
Because the attacker's code ran inside the victim's signed-in session with the same access as the legitimate ChatGPT site, Parameter wrote that "essentially, we could perform any action on behalf of the victim's ChatGPT account." In their controlled test the researchers listed the victim's recent conversations, opened a private chat that had never been shared with the attacker, and transmitted a small portion of it to a server they controlled. The code called ChatGPT's own signed-in APIs directly rather than scraping the visible screen, meaning the compromise extended beyond what was on display.
Parameter ran its private-chat proof between separate accounts rather than against real users and did not report any real-world use of the flaw.
How technologists, affected enterprises, and end users should view the incident
- Technologists and security teams: the chain highlights how browser frame messaging, third-party libraries, and permissive content-security allowances can combine—watch for listeners that accept cross-frame messages without origin checks and for features that permit raw HTML to cross trust boundaries.
- Affected enterprises and procurement leaders: shared links remain a practical risk vector even when no installation or credential handoff is required; verify vendor fixes and frontend versions when relying on SaaS collaboration features.
- End users and the general public: according to Parameter and OpenAI's coordinated response, users do not need to install updates or reset accounts — the fix was deployed on OpenAI's side and required no action from users.
Parameter traced the flaw to three design choices that aligned: MathLive acted on a message that changed its settings without checking the sender frame; that message could carry raw HTML as keyboard-layout data; and the injected HTML could create a frame that was not sandboxed and inherited the chatgpt.com identity. OpenAI's reproduction of the exploit, the P1 reclassification, and the cross‑frontend fix closed that chain by rejecting the messages the attack relied on.
For now the public record is concrete and narrow: a controlled proof-of-concept, a rapid remediation, and a $5,000 bounty. Parameter's writeup and OpenAI's patching removed the specific exploit path; whether similar chains will appear elsewhere depends on how widely the same patterns—message listeners accepting unvetted content and previews rendering raw HTML—exist in other features or products.
