What happened
Parameter Labs disclosed (2026-10-28, raised P2→P1 after OpenAI reproduced) that a public ChatGPT share link could run attacker-controlled JavaScript inside the signed-in session of anyone who opened it and clicked Preview once — or in a later variant just opened the link. The sandboxed Preview frame itself worked; the escape came through MathLive's cross-frame message listener on the main chatgpt.com page plus an unsandboxed iframe and a YouTube-based CSP bypass. OpenAI fixed two frontend versions and awarded a $5,000 bounty; no real-world exploitation reported.
Why it matters
ChatGPT is the most widely used AI product, and shared conversation links are routinely pasted into email, tickets and chat where recipients treat a chatgpt.com URL as trusted. The exploit chain turns an ordinary share link into authenticated account takeover and private-conversation exfiltration — a client-side attack surface that perimeter controls cannot stop, and a pattern (unvalidated postMessage + permissive CSP + rich untrusted content next to a bearer token) that likely recurs across other AI chat/agent platforms.
Attack vector
Stored/client-side XSS sandbox escape delivered through a normal ChatGPT share link. A malicious conversation containing an interactive graph loads the third-party MathLive library, whose virtual-keyboard postMessage listener accepts messages from any origin and writes attacker HTML into the trusted chatgpt.com page via innerHTML; the injected HTML spawns an unsandboxed iframe inheriting the chatgpt.com origin, and a CSP allowlist that includes YouTube is used to reflect executable JavaScript. The attacker script then reads the session access token from the DOM and calls ChatGPT's authenticated APIs.
Affected systems
ChatGPT web frontend (HTML Preview / Canvas artifacts feature); root cause is the MathLive math-input library's cross-frame postMessage listener plus a permissive CSP
Mitigation
Patched/fixed by OpenAI on 2026-10-26 across two affected frontend versions; no user action required. For orgs building AI chat or agent interfaces: audit every postMessage listener and every component that renders model/user content, treat shareable conversations as untrusted input, tighten CSP allowlists.