ChatGPT Share Links Could Hijack Your Account

Security researchers at Parameter Labs found a way to take over ChatGPT accounts using a single shared link. According to Simon Willison, the attack worked against ChatGPT’s HTML previews feature, which shows interactive custom HTML apps inside a sandboxed iframe. If a signed-in user opened a booby-trapped ChatGPT share URL, an attacker could steal their private data or take actions as them. OpenAI has fixed the hole and paid a $5,000 bug bounty.

⚡ Key takeaways

• What: A chain of small weaknesses let untrusted HTML escape ChatGPT’s sandbox and run JavaScript on ChatGPT itself.
• Who: Parameter Labs found and reported it. OpenAI patched it.
• Impact: Anyone signed in who clicked a malicious share link could have their private data leaked or their account used.
• Status: Fixed. There’s nothing for users to do now.
• Controversy: Willison calls the $5,000 payout “a bit cheap for a vulnerability this serious.”

🧩 How the attack chain worked

No single bug made this possible. Several reasonable-looking pieces lined up in exactly the wrong way. Here’s the sequence Willison lays out:

1. A math library with a side door. OpenAI uses the MathLive JavaScript library for graph support. MathLive ships with its own virtual keyboard, and a sandboxed iframe can trigger that keyboard in the parent page using postMessage(), the standard way browser frames talk to each other.
2. No check on who’s calling. Nothing stopped other sandboxed frames, including HTML preview frames, from sending those messages.
3. Unsafe HTML handling. The code that receives the message uses innerHTML, which means any sender could push custom HTML into the main ChatGPT page.
4. An unsandboxed iframe. innerHTML won’t run script tags directly. But it could insert a brand-new iframe with no sandbox restrictions at all.
5. A trusted domain that reflects code. OpenAI’s Content Security Policy (CSP), the browser rules that decide which scripts can run, blocked inline scripts and only allowed a short list of domains. YouTube was on that list. YouTube’s oEmbed endpoint could be used to reflect JavaScript back in a form the browser would run.
6. Game over. With JavaScript running on ChatGPT, pulling private user data from the APIs was trivial. The attacker could then send it out by hiding it in an image reference.

🔍 Why this matters

Artifact-style features are now everywhere. OpenAI used to call its version Canvas. Anthropic, Google and others ship similar tools that run model-generated or user-supplied code right next to your account data. The whole safety promise depends on that sandbox holding up.

What stands out here is how ordinary each piece looks on its own. A math keyboard. A messaging API. A YouTube allowlist entry. None of them sets off alarms alone. Put together, they gave an attacker full control of a logged-in session. That’s the real lesson for teams building AI products: your sandbox is only as strong as every third-party library and allowlisted domain sitting around it.

The delivery method makes it worse. Share links are built to be passed around, so a malicious one could spread through social media, forums or Slack channels without looking suspicious.

💰 The bounty debate

OpenAI paid $5,000. For a bug that allowed account takeover through a single click, many security folks will agree with Willison that this is low. Bounty sizes send a signal. If finding a full account-takeover chain on the world’s most popular AI chatbot pays this little, some researchers may decide it isn’t worth their time. Others may look for buyers who pay more.

🛠️ What builders should take from this

If you’re shipping any feature that renders untrusted HTML or AI-generated code:

• Check message origins. Every postMessage() handler should confirm who sent the message.
• Avoid innerHTML with outside input. Use safer DOM methods or sanitize strictly.
• Audit your CSP allowlist. Any allowed domain with an endpoint that echoes content back can turn into a script-injection path.
• Review third-party libraries. Bundled extras, like MathLive’s virtual keyboard, can open attack surface you never meant to expose.

As AI assistants get more powerful and more connected to personal data, expect more researchers to go after these sandbox boundaries. Willison’s post links to Parameter Labs’ full technical write-up for anyone who wants every step of the chain.