Parameter team discloses that ChatGPT public share links could hijack accounts; OpenAI has fixed the issue and rated it P1

The Parameter research team found that an attacker only needs to publish an ordinary ChatGPT public share link; once the victim opens it, the JavaScript within executes as chatgpt.com within their logged-in session, allowing enumeration of the session list, reading of private conversations that were never shared, and exfiltration of the data. The attack chain consists of interactive charts in the conversation loading MathLive, HTML Preview sending postMessage across frames without validating the origin, and then abusing the JSONP callback of YouTube oEmbed to bypass CSP. On October 26, OpenAI confirmed that both frontend versions had rejected the relevant messages and been fixed; the report was rated P1, with a total bounty of $5,000.