A single click on a seemingly harmless shared chat link was enough to compromise a victim's ChatGPT account entirely. Security researcher Mukul Goyal from Parameter Labs documented a sophisticated exploit chain that allowed attackers to hijack active user sessions directly on the chatgpt.com domain. OpenAI classified the issue as a top-tier P1 vulnerability, deployed a complete patch on October 26, 2026, and awarded a 5,000 dollar bounty through its official vulnerability disclosure program.
At the core of the attack was ChatGPT's interactive HTML Previews feature. This component is designed to allow developers and end users to view rich visual content, diagrams, and mathematical notation directly inside the browser window. To render complex mathematical expressions, the web interface relied on the popular open source library MathLive. Researchers discovered that MathLive listened for incoming window postMessage events and inserted payload data using unsafe innerHTML calls, opening an immediate door for cross-site scripting.
OpenAI had implemented defensive measures to contain dynamic code within a sandboxed iframe, backed by a Content Security Policy designed to stop malicious scripts from escaping. Goyal managed to circumvent these safeguards by leveraging a specific YouTube oEmbed bypass. This technique allowed the attack payload to bypass Content Security Policy restrictions and break out of the intended sandbox boundaries into the broader application context.
Because the payload escaped the sandbox, the malicious JavaScript executed in the authenticated context of the victim's live session on chatgpt.com. As soon as a user opened the crafted share link, the attacker gained unauthorized access to the Document Object Model. The exploit could invisibly query internal application interfaces, list private conversation histories, exfiltrate sensitive chat contents to remote servers, and trigger new prompts on behalf of the victim without any visible indication.
The incident highlights the substantial security surface introduced by modern, interactive AI user interfaces. Whereas early large language model applications only returned plain text strings, modern services embed execution sandboxes, data visualization tools, and third-party JavaScript libraries. Link sharing is one of the most widely used collaborative features across AI platforms, making such entry vectors especially dangerous. While OpenAI remediated the flaw swiftly, the case demonstrates that isolating untrusted dynamic output remains a complex hurdle.