Clicking a shared ChatGPT link could have handed an attacker your private chats
The exploit lived in the gaps between features. Rendering untrusted content didn’t make it trusted; it gave it a place to run.
That was the chain Parameter’s researchers reported, and they say OpenAI patched it on October 26.
The chain, now closed: a public shared conversation could run attacker JavaScript inside a victim’s signed-in session. A math library accepted cross-frame messages without checking where they came from, and an unsandboxed iframe plus a YouTube endpoint got around the content security policy. In Parameter’s tests it read private chats through ChatGPT’s own APIs. OpenAI rated it P1.
My read: the exploit lived in the gaps between features. Rendering untrusted content didn’t make it trusted; it gave it a place to run.
Your pick: if you build embedded previews, validate origin and source on every postMessage receiver before it changes state. Put untrusted content in properly sandboxed frames, including the ones you create dynamically. Keep CSP as a layer on top of those checks rather than the thing you rely on.
12 months: share and preview surfaces get login-level security review.
24 months: cross-frame message validation shows up in AI-product audit checklists.
36 months: testing playbooks cover exploit chains that span AI content and browser features.
Why I may be wrong: one patched disclosure doesn’t prove teams change their priorities. This may be a lesson that keeps getting relearned.
Which of your own share or preview pages has never had a security review?