ChatGPT share links could hijack your account: the $5,000 bug
A shared link is the most ordinary thing you can send someone, which is exactly why it is the best place to hide an attack. Two stories from the weekend — one about a link that could act as you, one about a turbine plant that a court says has to answer for its emissions.
Anyone who opened a crafted ChatGPT share link could have had their account read and used, without installing anything or pasting a line of code. Security firm Parameter published a full writeup of the chain it built and reported to OpenAI — "Do the Math: How We Took Over ChatGPT Accounts," by Mukul Goyal — published on Parameter's research blog, and The Hacker News picked it up on Friday, reporting that a shared ChatGPT link could run code in the session of whoever opened it. OpenAI fixed it and paid $5,000. The interesting part is not the payout. It is how little the victim had to do.
The chain starts somewhere reassuring. ChatGPT's Canvas Preview renders HTML in a sandboxed frame on a separate origin, and per Parameter's writeup that boundary held — code inside a Preview could not touch the parent page. The hole was next door. A legitimate chart in the same conversation loads MathLive, the math-typesetting library that renders equations, and MathLive installs a message listener inside the main chatgpt.com page. That listener used an origin policy of "none," meaning it accepted messages from any web address, and it did not check that the sender was a window it recognised. A crafted Preview could therefore hand it a layout containing raw HTML, which MathLive assembled into a string and assigned to innerHTML — marking the markup trusted instead of sanitising it. The output was an iframe with no sandbox attribute, inheriting chatgpt.com's origin. The page's content security policy blocked inline script, but it allowed YouTube embeds, and YouTube's oEmbed endpoint accepts a callback parameter. That is the whole trick: arbitrary JavaScript running as ChatGPT.
What that buys an attacker is the account. According to Parameter, the injected script lifted the victim's bearer token from the page bootstrap and used the app's own API to enumerate recent conversations, pull the text of a private conversation that had never been shared with anyone, and post the results to an external server. "Essentially, we could perform any action on behalf of the victim's ChatGPT account," the writeup states. Both pieces an attack needs — the chart and a previewable HTML block — survive into a normal share link, so the payload arrives as a conversation, not as a suspicious file.
The victim-side requirement shrank as the research went on. In the earliest version the target opened the link and clicked Preview once. By the end, per Parameter's timeline, the alert fired after roughly 4.5 seconds with no interaction at all, reproduced three times including after a hard refresh. The same writeup is explicit that the victim "did not need to install an App, join a Project, paste code, or open developer tools."
The disclosure timeline is the part OpenAI should be pleased with. Parameter confirmed the path on October 13, built cross-account share delivery by October 16, and submitted the report on October 18 with a private-conversation proof added a day later. OpenAI reproduced it on October 21 and raised severity from P2 to P1, shipped a frontend fix on October 22, tightened CSP on October 23, and confirmed both web frontends fixed on October 26 — eight days, with $5,000 paid. Parameter says the fix rejects the cross-frame MathLive messages.
Two things are missing from the record, and both matter for how you read the story. OpenAI has published no advisory of its own; the fix is documented only in the researcher's timeline and in The Hacker News's account, which says users do not need to do anything. And no one has disclosed how many accounts were reachable or for how long — Parameter describes controlled testing, not observed abuse. Anyone telling you "millions of accounts were exposed" is inventing a number, including us.
The takeaway is about trust boundaries, not about ChatGPT specifically. The sandbox was not broken; a third-party library sitting in the privileged page was talked into building an unsandboxed frame, and a content security policy that whitelists an embed provider turned out to whitelist a JSONP endpoint too. That is the same shape as yesterday's Cursor marketplace backdoor and every other assistant incident this year: the model was fine, the plumbing around it was not. If your product renders user-supplied HTML anywhere near a session that holds a session token, the audit question is not "is the iframe sandboxed." It is "which libraries in the trusted page accept messages, and from whom."
A federal judge refused to dismiss the NAACP's Clean Air Act lawsuit against SpaceXAI over the gas turbines powering its Memphis-area data centers, and in doing so closed off the defence the whole gas-fired data center boom was counting on. Judge Debra M. Brown of the U.S. District Court for the Northern District of Mississippi denied the motion to dismiss in a 28-page opinion filed Friday, the opinion is published in full by Earthjustice, and CNBC reported the ruling on Saturday. The suit, filed in April 2026 by the Southern Environmental Law Center and Earthjustice on the NAACP's behalf, alleges that xAI and its subsidiary MZX Tech installed and ran at least 27 gas turbines in Southaven, Mississippi, between August and December 2025 without an air permit.
SpaceXAI's argument was that the turbines are "mobile" sources and therefore exempt from permitting, that the NAACP had no right to sue under the Clean Air Act, and that citizen suits of this kind are unconstitutional. Brown rejected all three in a single paragraph that doubles as the opinion's roadmap: the plaintiffs have statutory standing, the combustion turbines "are not 'mobile sources' under Mississippi's SIP," and the citizen-suit provision violates neither Article II nor the private nondelegation doctrine. On the constitutional point the reasoning is narrow and worth quoting: "Because citizen suit plaintiffs sue on their own behalf, in their own name, and seek penalties that redress harm to themselves, they are not exercising the federal government's executive power."
The numbers in the complaint are the reason this is not a paperwork dispute. The 27 turbines total at least 495 megawatts, and the plaintiffs plead roughly 1,700 tons of nitrogen oxides, 580 tons of carbon monoxide, 19 tons of formaldehyde and 180 tons of fine particulate matter a year. Statutory penalties run up to $124,426 per day per violation. The backdrop is a county that has failed American Lung Association ozone grades and a city that ranks among the country's asthma capitals — and a state regulator that issued a permit for 41 permanent turbines at the site in March 2026 while assessing $6.1 million in penalties across three Southaven sites, as reported by the DeSoto County News and the Commercial Appeal.
Read it for what it is: a denial of a motion to dismiss, not a finding that anyone broke the law. Every factual allegation is taken as true at this stage, and the case now goes to discovery. But the ruling has reach beyond Mississippi. The same court refused on October 19 to let the Department of Justice end the case, allowing it only to intervene — a rebuff the Fifth Circuit let stand. And "the turbines are portable, so they are not stationary sources" is the load-bearing legal theory behind a large share of the gas plants now being built for AI. One district judge has now said it does not work.
What to watch: whether SpaceXAI appeals to the Fifth Circuit before discovery, and whether the Environmental Protection Agency's parallel push to strip public comment from data center pollution permits changes the terrain underneath this case.
If a link in someone else's chat can act as you, what should a browser tab full of agent extensions be allowed to do? Write to us via our contact page.
