A shared ChatGPT link could read the victim's session token and private chats, Parameter says

Security firm Parameter published research on October 28 showing that opening a crafted shared ChatGPT conversation could hand an attacker the viewer's account. The shared chat contained an interactive graph that loaded the MathLive library, which installed a message listener on the main ChatGPT page without checking who sent the message. An HTML Preview running in an isolated frame then sent it attacker HTML, which MathLive inserted into the page, creating an unsandboxed frame that inherited the chatgpt.com origin. A YouTube JSONP endpoint allowed by ChatGPT's content security policy got the attacker's script to run. The script read the session token and account ID from the page and called ChatGPT's APIs as the victim, listing recent conversations and exfiltrating a private chat. Parameter reported it on October 18; OpenAI raised it to P1 and confirmed both web frontends were fixed on October 26.

Why it matters

No password, MFA prompt or OAuth consent was involved. Once the script ran in the page's origin, the bearer session token readable from that page was the whole identity, which is the core weakness behind session hijacking and the session replay Huntress tracked last week.

For teams building AI apps that render user-supplied content, three checks from this chain apply directly: verify the sender's origin on every postMessage handler, never pass message data to innerHTML, and sandbox every frame that shows untrusted content. Keep session tokens out of script-readable storage where you can, and look at proof-of-possession binding such as Device Bound Session Credentials so a token copied out of the browser stops working. More on the attack class in session cookie theft.

Source: Parameter