Do the math: How we took over ChatGPT accounts
Security researchers disclosed a cross-frame scripting flaw that they say let a shared conversation link act inside a signed-in ChatGPT session.
TL;DR
- Parameter said a crafted shared conversation could run attacker-controlled JavaScript in a visitor’s signed-in session.
- The researchers said the flaw exposed private conversations through authenticated ChatGPT APIs.
- OpenAI fixed the issue on October 26, before Parameter published its account.
Parameter described a flaw in ChatGPT’s web interface in which a crafted shared conversation could load attacker-controlled JavaScript in the context of a signed-in visitor. The researchers said the code could then interact with authenticated ChatGPT APIs. [1]
The researchers said the chain allowed access to private conversation data without prior access to the victim’s account. Cloud Security Alliance’s technical review describes the same cross-frame messaging and script-execution path. [1] [2]
Parameter said it reported the issue to OpenAI through the bug bounty program and that OpenAI fixed it on October 26. The disclosure was published after the fix, according to the research account. [1] [2]
The public accounts document a reproduced vulnerability and a reported fix, but do not establish that attackers exploited it in the wild. The number of potentially affected users and any historical misuse remain undisclosed. [1] [2]
Why it matters
The flaw illustrates how content shared through a trusted AI service can become an execution path inside an authenticated session. The disclosure also makes the fix status and evidence of real-world exploitation important to keep separate.
Editor's note
The technical account is from the researchers who found the flaw; Cloud Security Alliance reviewed the described mechanics. No in-the-wild exploitation is reported.