Security researchers discovered that ChatGPT's public share feature could be weaponized into a full account takeover requiring zero victim interaction beyond clicking a link. The attack chain exploited the intersection of two seemingly innocuous features: an interactive graph that loaded the MathLive math library, and ChatGPT's HTML Preview sandbox. Neither feature was dangerous alone. Together, they created an authenticated cross-site scripting path that OpenAI classified as P1 severity and patched on October 26, 2026. The mechanism was elegant in its indirection. ChatGPT's HTML Preview runs inside a sandboxed iframe on a separate origin — standard isolation practice. The Preview cannot read the parent ChatGPT page. But when a conversation also contains an interactive graph, ChatGPT loads MathLive into the main page, which installs a postMessage listener for virtual keyboard events. That listener accepted messages from any origin and rendered attacker-controlled HTML directly into the main chatgpt.com document via innerHTML, with a helper function marking the string as trusted without sanitization. The researchers escalated from HTML injection to JavaScript execution through two additional bypasses. First, they used an iframe with srcdoc — which inherits the parent's origin — to get code running as chatgpt.com. Then they sidestepped ChatGPT's Content Security Policy by exploiting a JSONP-style callback on YouTube's oEmbed endpoint, which was already whitelisted. The callback parameter allowed arbitrary JavaScript execution because YouTube placed the callback into its error response before validating it. A carefully crafted callback ending in ;void neutralized the appended response body. The critical escalation was making the entire chain deliverable through a normal public share link. The attacker crafted a single conversation containing both a legitimate graph (to load MathLive) and a later HTML Preview block (to send the malicious postMessage). ChatGPT's share feature preserved both elements. In the most refined version, the Preview auto-opened, making the victim's only action clicking the shared link. The payload fired in approximately 4.5 seconds. Once JavaScript was running as chatgpt.com with the victim's session context, the researchers demonstrated direct authenticated API calls: enumerating the victim's conversation list, retrieving full message content from a private conversation that had never been shared, and exfiltrating data to an external server. This was not screen-scraping — it was direct backend API access with the victim's credentials. The vulnerability pattern here is a textbook example of emergent risk from feature composition. Each component — Preview sandboxing, MathLive's keyboard listener, CSP with YouTube whitelisting, the share feature — passed individual review. The security failure existed only in the interaction graph between them. OpenAI's response was fast (P1 classification, patched promptly), but the architectural lesson is that no amount of per-feature security review catches composition bugs without cross-feature threat modeling. The broader signal is that as AI platforms accumulate features — code execution, file handling, sharing, third-party libraries, plugin ecosystems — the attack surface grows combinatorially, not linearly. ChatGPT is now a complex web application with the feature density of a collaboration platform, but its security model still inherits assumptions from when it was a simple chat interface. Every new feature interaction is a potential sandbox escape waiting to be found.
