Security firm Parameter published 'Do the Math: How We Took Over ChatGPT Accounts' on 28 October 2026. It says it found a way to turn an ordinary public ChatGPT share into attacker-controlled JavaScript running inside the signed-in session of whoever opened it. Per Parameter, a graph in the shared conversation loaded the MathLive math library into the main ChatGPT page, and MathLive's on-screen keyboard listener accepted messages from any web address; an HTML Preview in the same conversation used it to insert an unsandboxed frame that inherited the chatgpt.com identity, and because ChatGPT's content security policy allowed scripts from YouTube, a YouTube oEmbed callback supplied the code.

Parameter says it confirmed the code could enumerate the victim's conversation list, retrieve content from a private conversation that had never been shared with the attacker and send data from it to an external server, and that 'Essentially, we could perform any action on behalf of the victim's ChatGPT account.' In its most stable reproduction the victim opened the share and clicked ChatGPT's Preview button once; in a later version Preview opened automatically, so opening the link was the only click.

Parameter says it submitted the report to OpenAI's bug bounty program on 18 October, OpenAI reproduced the issue on 21 October and raised the severity from P2 to P1, and on 26 October OpenAI confirmed both ChatGPT web frontends rejected the reported messages, resolved the issue and awarded a total bounty of $5,000.

According to The Hacker News, Parameter does not report any real-world use of the flaw, and ChatGPT users do not need to do anything because the fix is on OpenAI's side. (sources: Parameter; The Hacker News)