ChatGPT flaw that took over accounts with one link is fixed, and researchers got $5,000

Opening a ChatGPT chat link could be enough to hand your account to someone else. Security firm Parameter described such a flaw on October 28, 2026. An attacker could publish a prepared chat with the normal share feature and send the link by email or message. When someone opened it, the attacker's code started running inside that person's signed-in account. OpenAI closed the flaw on October 26, and users do not need to do anything.

What this is about

ChatGPT can show small web pages and graphs inside a chat. For safety, those pages run inside a sealed box, and code in the box cannot reach your account. The box's only link to the outside is a message channel, like a mail slot in a door. The box can send messages to the main page, but whoever receives a message has to check who sent it.

That is where the flaw appeared. Graphs in a chat loaded a math tool called MathLive into the main page. The tool listened for virtual keyboard messages and never checked the sender. Picture a clerk who carries out every note pushed through the mail slot without asking who wrote it. The researchers sent a note from the sealed box saying "change the keyboard like this" and hid their own code inside it. The main page wrote the note straight into itself.

One more barrier stood in the way. ChatGPT only runs code from addresses it trusts, and YouTube is one of them. The researchers used a YouTube address to make their code look as if it came from there. Then they placed the graph and the sealed box in one public chat, so the whole attack fit into a single link.

What an attacker could do

The code acted on ChatGPT in the victim's name. Parameter confirmed that it listed the victim's chats, read a private chat never shared with the attacker and sent data to an outside server. That is why the firm says any action on the account was possible. The victim did not need to install an app, sign up for anything or type a password. The first version took one press of the Preview button, and a later version needed only opening the link.

How it was closed

Parameter reported the flaw to OpenAI's bounty program on October 18. OpenAI reproduced it on October 21 and raised its severity from P2 to P1, one of the highest levels. The fix came in two stages and finished on October 26, and the researchers received $5,000 in total. Because the fix was made on the server, no app update is needed. The write-up gives no information about use in real attacks.

Why it matters

What makes this flaw interesting is that every piece looked harmless alone. The sealed box did its job, the graph tool was ordinary, YouTube was a trusted address and sharing a chat is a normal feature. The problem appeared only when they came together. Parameter's simple lesson for developers is that code receiving a message should check the sender. This information rests on the firm's own account, and Parameter also sells AI-assisted penetration testing. For a fuller picture, follow reviews from independent researchers too.

Sources: Parameter