AI
Researchers say a shared ChatGPT conversation could steal private account data
Researchers report that a malicious public ChatGPT conversation could combine an HTML Preview, a graph component and an unsafe cross-frame message path to execute JavaScript in the signed-in ChatGPT page. In their testing, the code enumerated private conversations, retrieved message content and sent selected data to an external server without requiring an app installation. OpenAI reproduced the issue, classified it as P1 and deployed fixes by 26 October. The report’s demonstrated chain concerns the web frontend and does not establish that every account action was exploited.
Editorial summary · Publisher article
What matters
- The exploit crossed the Preview sandbox through a MathLive message listener that did not authenticate its sender.
- An unsandboxed frame inherited ChatGPT’s web identity, allowing authenticated API requests.
- The researchers say a victim needed only to open a public share, with one tested path requiring no additional click.
- OpenAI blocked the relevant cross-frame messages across two frontend versions.
The security lesson
The researchers argue that isolation fails when trusted components accept messages from untrusted frames, permit raw HTML or create unsandboxed documents. They recommend checking both message origin and source, avoiding HTML in cross-window settings and treating content security policy as defense in depth.
Why the impact was serious
The issue was more than page modification: code running in the authenticated site context could call conversation APIs and read private data. The report says the same boundary could expose other frontend actions, though its proof demonstrated conversation access.
Context & caveats
- The account is a researcher-authored disclosure, and the reported vulnerability was fixed before publication according to the supplied evidence.
Why this made the edition
The packet provides an unusually complete technical account of a serious cross-feature web vulnerability, its demonstrated data-access impact and OpenAI’s remediation. The findings are attributed to the reporting researchers and should not be generalized beyond the described issue.
Source material