ChatGPT account takeover method

Parameter AI says its researchers found a way for a public ChatGPT share to run attacker-controlled JavaScript inside the signed-in session of whoever opened it. The attack combined a graph with an HTML Preview. Together, the features let code cross the Preview’s sandbox, run on the main ChatGPT page, and use the victim’s authenticated session. The researchers say they could list conversations, retrieve content from a private conversation, and send that data to an external server. In their final version, opening the shared link was the only action needed. Parameter AI’s technical report explains how the chain worked.

OpenAI fixed the issue on October 26, 2026, and classified the report as P1. That matters to operators because a feature that appears safely isolated can still become a path into sensitive account data when it interacts with other features. This report describes a specific flaw, not evidence that accounts were broadly attacked. It’s a useful reminder to include shared content and embedded previews in security reviews, especially when they can act within a signed-in session. This is the kind of risk we build into an AI command centre, so teams can keep track of what their AI tools can access and where the exposure points may be.