A public ChatGPT share link was enough to take over an account. OpenAI rated it P1 and paid $5,000

The number to hold onto is the pair: P1 severity, $5,000. On 26 October OpenAI confirmed both versions of its web frontend rejected the messages in the report, marked the issue resolved, and paid a total bounty of five thousand dollars. The report, published two days later by Mukul Goyal at Parameter, describes turning an ordinary public ChatGPT conversation into attacker-controlled JavaScript inside the signed-in session of anyone who opened the share link.

One link, no install

No App to connect, no Project to join, no code to paste, no developer tools. By 16 October the team had delivery between separate accounts and workspaces with one click on ChatGPT's own Preview button. By 17 October a share opened Preview automatically, with the alert appearing after roughly 4.5 seconds, reproduced three times in a separate account and again after a hard refresh.

They submitted on 18 October and added a private-conversation proof a day later. OpenAI reproduced it on 21 October and raised severity from an initial P2 triage to P1, then spent the week rolling fixes across two frontends while CSP changes blocked part of the chain.

Every component did its job

A real graph in the conversation loaded MathLive, which installed a listener in the main chatgpt.com page for keyboard messages. That listener accepted a layout update without checking the sender's origin or source window, and the layout could carry raw HTML. MathLive joined the layout into markup, passed it through a helper named createHTML that marked the string trusted rather than cleaning it, then inserted an unsandboxed srcdoc iframe inheriting the chatgpt.com origin.

ChatGPT's content security policy blocked inline script but allowed YouTube, whose oEmbed endpoint reflected an invalid JSONP callback into its response before returning an error; the callback ended in ;void, which neutralised the error object appended after it. The sandbox never broke. Preview code could not read the parent page, only convince something there to act for it. Blocking the YouTube endpoint alone, the researchers note, would have removed one path to JavaScript and left the bug.

What the number says

A P1 rating next to $5,000 is the honest measure of the market. The proof went past an alert: the payload enumerated the victim's recent conversations, requested messages from a private conversation never shared with the attacker, and sent a selected value off-site in an image request. With the application's authenticated access, it could act on the account, not just the page. Five thousand dollars is the price of a laptop, and roughly what a bug needing one click is worth.

The narrower lesson is about seams. Public sharing, Preview, MathLive, frame creation and CSP each behaved reasonably alone; the chain existed only where they met. That is the failure mode AI products will keep shipping, because features multiply faster than anyone tests the spaces between them.