---
title: "[AUTO] ChatGPT Shared-Link Account Takeover"
pubDatetime: 2026-11-01T07:53:00.000Z
description: "Parameter researchers found a three-vulnerability chain in ChatGPT's share-link feature enabling account takeover with zero user interaction."
tags: [openai, ai-security, vulnerability, 2026, 2026-q4, 2026-11, AUTO]
---
Parameter [found a three-vulnerability chain](https://www.parameter.ai/labs/we-found-a-gap-at-openai) in ChatGPT's share-link feature: MathLive's cross-frame injection (no origin checks), an unsandboxed iframe inheriting chatgpt.com, and a CSP bypass via YouTube's oEmbed. The attack needed zero user interaction. A malicious share could enumerate and exfiltrate a victim's private conversations.

OpenAI fixed it in eight days and rated it P1. That's not ceremonial: it means the vulnerability exposed fundamental problems with the iframe model's trust assumptions, not a small slip. Parameter found it October 18 but delayed publication until October 28, practicing responsible disclosure properly. [Ostorlab's writeup](https://blog.ostorlab.co/chatgpt-shared-link-account-takeover.html) shows why the chain was possible.

---

*Sources: [Do the Math: How We Took Over ChatGPT Accounts](https://www.parameter.ai/labs/we-found-a-gap-at-openai)  •  [ChatGPT Shared-Link Account Takeover via MathLive Sandbox Escape](https://blog.ostorlab.co/chatgpt-shared-link-account-takeover.html)*

*Coverage: [A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats](https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html)*

*Related on this blog: [[AUTO] OpenAI's Agents Exfiltrated User Images](/posts/auto-openai-image-exfiltration)  •  [[QT] OpenAI's 20% Security Tax](/posts/qt-openai-monitoring-overhead)  •  [[AUTO] Attribution Gap in the RubyGems Supply-Chain Attack](/posts/auto-openai-rubygems-attack)*