Do the Math: ChatGPT Share Links & Account Risk

Your coworker drops a ChatGPT share. You open it. Done?

Most of us treat a ChatGPT /share/... link like a screenshot with better formatting: read-only, sandboxed, nothing to do with the rest of our account. That assumption just got stress-tested in public.

Parameter’s October 2026 write-up – Do the Math: How We Took Over ChatGPT Accounts – is circulating for a blunt reason. A normal public share ran attacker JavaScript inside the victim’s signed-in chatgpt.com session. Private chat lists. Thread content that was never shared. Authenticated frontend APIs, called as you. The required action was opening the link. No install. No “join project.” No paste-into-console ritual.

OpenAI fixed the reported path on October 26 (raised to P1; $5,000 bounty). You’re not supposed to panic-rotate your password tonight. You are supposed to rethink shares, sessions, and any product that loads rich UI libraries next to logged-in cookies.

What “Do the math” actually changed

Mukul Goyal’s team at Parameter didn’t ship a fake login page. They stacked features ChatGPT already exposed: an interactive graph that pulled MathLive, plus HTML Preview.

Preview stayed boxed. The gap sat on the main page – a MathLive postMessage listener that treated keyboard-layout updates as coming from anywhere (origin policy effectively open). Layout data could carry HTML, landed through a path that didn’t sanitize hard enough, and an unsandboxed srcdoc frame inherited chatgpt.com. CSP stopped some scripts; a YouTube oEmbed-style callback still finished execution.

Code running as the real site made conversation-list and private-message endpoints fair game. Practically that’s account takeover: not “stole the password,” but “used your browser session.”

Pro tip: Treat every shared AI conversation the way you’d treat an email attachment from someone you half-know. The text can be fine. The runtime around it is what just got interesting.

Hands-on: lock down your ChatGPT side in under 10 minutes

Beginner path only. No bounty hunting.

1. Active sessions. Web app: profile menu → Settings → Security and Login (labels drift) → Active Sessions. Kill anything you don’t recognize. Shared laptop leftover? This is the cleanup.
2. Shared links you created. Settings → Data controls → Shared links → Manage. Delete stale shares. A share is a public snapshot of that thread; scrubbing unused ones cuts sprawl even though this bug was about opening someone else’s trap, not leaking your own snapshot.
3. Connectors and memory. Gmail, Drive, GitHub, similar – skim what chats and tools can reach. Session-level trouble hurts more when the assistant already holds outbound grants.
4. MFA / passkeys where offered. Session theft ≠ password stuffing. MFA still raises the floor for boring attacks that never trend on Security Twitter.
5. Habit. Untrusted share? Fresh private window while logged out – or don’t open it until you trust the sender. The fixed chain needed you signed in on chatgpt.com for the interesting payload.

After the drop, community threads keep repeating the same relief: no confirmed mass abuse in the wild before the patch, and the fix lives on OpenAI’s frontends. You don’t install a ChatGPT “security update” yourself. UI paths above match common web-app documentation (including account-security writeups such as TechCrunch’s guide); menus move, so click what you see.

If you build products: the 15-minute postMessage audit

Skip the romance about novel exploit chains. What stood out is how dull each piece looked alone – math widget, diagram tool, code preview, media embed – the same inventory many authenticated shells already ship.

On any codebase that embeds third-party UI beside a logged-in shell:

• Grep addEventListener('message' and onmessage.
• Handlers that touch DOM, storage, or auth state need an explicit allowlist: event.origin (and ideally event.source) before the body means anything.
• MathLive: don’t leave virtual-keyboard origin validation at the library default. Same-origin or custom validator. Never feed attacker-influenced HTML into layout markup; if markup is unavoidable, run a real HTML sanitizer.
• iframe / srcdoc built from cross-frame input gets a strict sandbox unless you can document why not.
• CSP allowlists (CDNs, YouTube, analytics) are backups. Untrusted HTML already in a privileged document means you lost fight one.

// Pattern only - tighten to your real origins
window.addEventListener('message', (event) => {
 if (event.origin !== 'https://app.example.com') return;
 // then validate shape, then act
});

Parameter’s “what went wrong” list is the same sermon working web teams skip under deadline: verify sender and permitted window, no raw HTML in cross-window settings, sandbox dynamic documents, CSP as depth – not the whole wall.

Advanced angle: residual risk after “it’s fixed”

ChatGPT frontends rejecting the bad MathLive messages closed the reported path. That is not “every MathLive install on the internet hardened.”

As of community checks around the disclosure window, MathLive could still default the keyboard originValidator to an open policy (reports still saw the string 'none' on npm 0.111.1) unless the host app overrides it. Other products embedding MathLive beside untrusted frames inherit that class of gap.

Different bug, easy to mix up: CVE-2026-54705 is LaTeX text-mode escaping XSS in MathLive, fixed in 0.110.0. Patch it. Don’t pretend it is the share-link postMessage origin story.

Rollout was uneven on purpose in the timeline Parameter published: one frontend moved earlier (around Oct 22), CSP changes cut part of the chain while another update lagged, both paths confirmed only on Oct 26. Multi-frontend products always leave that short messy window.

One more detail pure “click Preview” recaps gloss over: graph/MathLive init and HTML Preview load were independent. Payload messages could fire before the listener existed, so a stable carrier needed short retries and a one-shot guard. Races like that are why “it only works if you click exactly once” writeups age badly.

Is $5,000 the right P1 number when “open a share” implied private-chat confidentiality loss? Security Twitter is chewing on that. I’m not pricing OpenAI’s bounty table – only noticing impact-vs-payout comparisons go public fast, and those comparisons change who files the next chain.

Honest limitations of this guide

No reproduction steps for the old payload. That window is closed on ChatGPT, and attack procedures don’t help people who need to stay safe.

We also can’t promise zero residual risk on every third-party site that copied a similar feature mix. Targeted link-lures still reward session and connector hygiene after big patches. Mobile apps, API keys, and stealer malware are separate failure modes this research never claimed to cover.

FAQ

Do I need to change my ChatGPT password because of this?

No – not for this fixed share-link path. Rotate if you reuse the password elsewhere, spot a weird session, or hit real phishing. Standard hygiene, not a special emergency.

Can someone still own my account with a share link today?

On current ChatGPT web, that exact chain shouldn’t replay: Parameter’s timeline says both frontends rejected the cross-frame MathLive messages by October 26, 2026. Picture a coworker Slack-dropping a “quick graph” share tomorrow – the durable issue isn’t yesterday’s PoC, it’s that share UIs still sit beside privileged cookies and fat client libraries. New bugs can show up; the hygiene list still earns its keep.

I embed MathLive / previews in my own SaaS – what’s the minimum fix?

Treat inbound message events as hostile until the handler proves origin and source. Force a strict origin validator on anything MathLive-like. Stop sending untrusted strings into innerHTML-style sinks. Sandbox dynamic frames. Grep for listeners before each release – five minutes, not a quarter-long rewrite.

If you only bump the package because you saw CVE-2026-54705, you’re patching the LaTeX text-mode XSS. Useful. Different bug from ChatGPT’s share-link origin-policy chain. Library defaults (including an open originValidator until you override it) remain your problem even when OpenAI’s frontends are clean.

Next action: open ChatGPT, review Active Sessions and Shared links, then grep your repos for message listeners before you close the laptop.