In October 2026, researchers discovered a critical vulnerability in ChatGPT’s public share feature that allowed attacker-controlled JavaScript to run inside a victim’s authenticated session simply by opening a shared link. By exploiting an unverified postMessage listener in MathLive and bypassing Content Security Policy via YouTube’s JSONP endpoint, the attack executed unsandboxed scripts with full chatgpt.com privileges, enabling enumeration and exfiltration of private conversations and complete account takeover. OpenAI fixed the flaw on October 26 by blocking unauthorized cross-frame messages and updating frontend protections, highlighting the importance of end-to-end verification in sandboxed environments and cross-feature security.
Do the Math: How We Took Over ChatGPT Accounts
