--- title: We Took over ChatGPT Accounts | daily.dev description: Security researchers found a way to turn a public ChatGPT share link into attacker-controlled JavaScript running in the victim's signed-in session. Just... canonical: https://daily.dev/posts/we-took-over-chatgpt-accounts-bs6zmi9ki twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: We Took over ChatGPT Accounts | daily.dev og:description: Security researchers found a way to turn a public ChatGPT share link into attacker-controlled JavaScript running in the victim's signed-in session. Just... og:url: https://daily.dev/posts/we-took-over-chatgpt-accounts-bs6zmi9ki og:image: https://api.daily.dev/og/posts/Bs6zMI9kI.png og:image:alt: We Took over ChatGPT Accounts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # We Took over ChatGPT Accounts **[Hacker News](https://daily.dev/sources/hn)** · 13 min read · 0 upvotes · 0 comments ## Summary Security researchers found a way to turn a public ChatGPT share link into attacker-controlled JavaScript running in the victim's signed-in session. Just opening the shared link let the payload enumerate the victim's conversations, read a private conversation never shared with the attacker, and exfiltrate data to an external server. The chain combined a ChatGPT graph feature that loaded the MathLive math keyboard library with an HTML Preview, since MathLive accepted cross-frame postMessage input without checking the sender and let it inject raw HTML. An unsandboxed iframe plus a YouTube oEmbed JSONP endpoint bypassed ChatGPT's CSP to achieve script execution. OpenAI rated it P1, fixed it on October 26, 2026, and paid a $5,000 bounty. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did a ChatGPT shared conversation link lead to a full account takeover? A malicious public ChatGPT share combined a graph that loaded the MathLive library with an HTML Preview that sent unauthenticated postMessage calls to it. MathLive accepted raw HTML as keyboard-layout data and inserted it via innerHTML, then an unsandboxed iframe with srcdoc and a YouTube JSONP endpoint bypassed CSP to run arbitrary JavaScript as chatgpt.com, enabling API calls with the victim's session. _Developers auditing postMessage and CSP setups can track writeups like this on daily.dev._ ### What postMessage validation mistake let attacker HTML reach the ChatGPT page? MathLive's top-level controller used an origin policy of 'none', accepting cross-frame messages from any web address without verifying event.origin or event.source. It also let a message that changed the virtual keyboard layout carry raw HTML, which was then assigned via innerHTML through a 'createHTML' wrapper that only marked the string trusted instead of sanitizing it. _Teams hardening cross-frame messaging use details like this to catch the same gap before shipping._ ### How was ChatGPT's Content Security Policy bypassed to run arbitrary JavaScript? The CSP blocked inline JavaScript but allowed scripts from www.youtube.com. YouTube's oEmbed endpoint accepted a JSONP-style callback parameter and placed it into its response before validating it, so appending ';void' to the callback let the attacker's code run as a script loaded from an allowed origin, executing inside an unsandboxed srcdoc iframe with the chatgpt.com identity. _Developers weighing which third-party script sources to allow in CSP can learn from this exact bypass._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 108 comments across hackernews (as of 2026-10-31). **TL;DR:** Most of the discussion focuses not on the technical exploit itself but on outrage that OpenAI only paid a $5,000 bounty for a P1 account-takeover vulnerability, with many arguing this discourages responsible disclosure and invites selling exploits on the black market instead. **Sentiment:** 5% positive · 15% mixed · 80% skeptical **The case for** - A few note that public, even modest, bounty payouts are still preferable to the opacity of selling exploits on illicit markets. - Some find the technical write-up itself well done, appreciating the creative chaining of old techniques like postMessage, JSONP, and iframes. **The pushback** - Many feel $5,000 is an insultingly low payout for a company valued in the trillions, especially for an account-takeover bug. - Several argue that low bounties discourage future responsible disclosure and may push researchers toward selling vulnerabilities on gray/black markets instead. - Some see the bug as evidence that OpenAI's security practices and internal auditing are weak despite massive engineering spend. - A side debate criticizes the industry's reliance on sprawling, complex codebases (and 'AI-written' code) as increasing attack surface and bug risk. - Some are cynical that OpenAI's AI-driven engineering claims ring hollow if such a basic cross-frame postMessage flaw made it to production. **By community** - hackernews (heated): Heavy disagreement centers on whether the $5,000 bounty is fair, with a smaller side-thread debating code complexity, OAuth confusion, and ethics of selling exploits versus reporting them. **Hottest debate:** Whether OpenAI's $5,000 bounty for a critical account-takeover bug is reasonable or an insult that will push researchers toward selling exploits instead of disclosing them. **Open questions** - Would AI-assisted vulnerability scanning have caught this bug before a human researcher found it manually? - Should bug bounty amounts be tied to blast radius/impact or to the effort required to find the issue? - Is it ethical or practical for researchers to sell such vulnerabilities on underground markets instead of reporting them? **Highlights** > That’s so low. That’s the level of bounty I awarded researchers when I was managing the bug bounty program at a small startup, it’s just ridiculous coming from a large company like OpenAI > — [dgellow on hackernews · 1 comments](https://news.ycombinator.com/item?id=50316244) > If OpenAI is throwing pennies at reported issues, that's disrespect beyond just wanting money. It screams "we don't care, stop telling us" > — [Catloafdev on hackernews](https://news.ycombinator.com/item?id=50317679) > I think there was another HN discussion about it re bounty value and as far as I remember the issue is not that big companies are greedy in that case, but rather that over time it’s strategically better to have lower bounties so less people are interested in it. 5 or 50k doesnt matter to them. And this bug in terms of severity is very high imho. > — [jwpapi on hackernews](https://news.ycombinator.com/item?id=50317315) > Now what about those millions of lines of code? Wasn’t the agent swarm supposed to take care of it? All jokes aside this is exactly what happens as you build larger monoliths, system complexity and bug surface increases logarithmically… so in all seriousness you want to reduce LOC as much as possible. Maybe this can teach OpenAI a lesson to produce software that’s correct and adhere to established engineering standards over sensationalised “we built so much code” promotional material. > — [usernametaken29 on hackernews · 5 comments](https://news.ycombinator.com/item?id=50315368) > The post seems to be talking about a html injection via a postMessage call where the receiver didn’t check who sent the message, which is a well known vulnerability entry point. Did I miss where OAuth had anything to do with this?? > — [brabel on hackernews](https://news.ycombinator.com/item?id=50316101) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50314699) · 210 points · 108 comments ## Similar posts on daily.dev - [Researcher Claims Control of ChatGPT Secure Sandbox](https://daily.dev/posts/researcher-claims-control-of-chatgpt-secure-sandbox-pb2mhjtib) · Dark Reading · 0 upvotes · 0 comments - [ChatGPT blindly trusts browser content, turning the page into a payload](https://daily.dev/posts/chatgpt-blindly-trusts-browser-content-turning-the-page-into-a-payload-6fevg9knb) · The Register · 0 upvotes · 0 comments - [The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT](https://daily.dev/posts/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt-1fq4tuxhb) · Check Point Research · 0 upvotes · 0 comments - [HackedGPT: Novel AI Vulnerabilities Open the Door for Private Data Leakage](https://daily.dev/posts/hackedgpt-novel-ai-vulnerabilities-open-the-door-for-private-data-leakage-v1llnf112) · Security Boulevard · 0 upvotes · 0 comments - [ChatGPT Won't Let You Type Until Cloudflare Reads Your React State. I Decrypted the Program That Does It.](https://daily.dev/posts/chatgpt-won-t-let-you-type-until-cloudflare-reads-your-react-state-i-decrypted-the-program-that-doe-jrovbngfp) · Hacker News · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#chatgpt](https://daily.dev/tags/chatgpt) [View this post on daily.dev](https://daily.dev/posts/we-took-over-chatgpt-accounts-bs6zmi9ki) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"We Took over ChatGPT Accounts","url":"https://daily.dev/posts/we-took-over-chatgpt-accounts-bs6zmi9ki","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/we-took-over-chatgpt-accounts-bs6zmi9ki"},"datePublished":"2026-10-31T14:13:49.150Z","dateModified":"2026-10-31T17:45:04.569Z","description":"Security researchers found a way to turn a public ChatGPT share link into attacker-controlled JavaScript running in the victim's signed-in session. Just...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b14c920f7ae491c1b48ba4866a71ef78?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b14c920f7ae491c1b48ba4866a71ef78?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/we-took-over-chatgpt-accounts-bs6zmi9ki","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,chatgpt","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"We Took over ChatGPT Accounts"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/we-took-over-chatgpt-accounts-bs6zmi9ki#faq","mainEntity":[{"@type":"Question","name":"How did a ChatGPT shared conversation link lead to a full account takeover?","acceptedAnswer":{"@type":"Answer","text":"A malicious public ChatGPT share combined a graph that loaded the MathLive library with an HTML Preview that sent unauthenticated postMessage calls to it. MathLive accepted raw HTML as keyboard-layout data and inserted it via innerHTML, then an unsandboxed iframe with srcdoc and a YouTube JSONP endpoint bypassed CSP to run arbitrary JavaScript as chatgpt.com, enabling API calls with the victim's session. Developers auditing postMessage and CSP setups can track writeups like this on daily.dev."}},{"@type":"Question","name":"What postMessage validation mistake let attacker HTML reach the ChatGPT page?","acceptedAnswer":{"@type":"Answer","text":"MathLive's top-level controller used an origin policy of 'none', accepting cross-frame messages from any web address without verifying event.origin or event.source. It also let a message that changed the virtual keyboard layout carry raw HTML, which was then assigned via innerHTML through a 'createHTML' wrapper that only marked the string trusted instead of sanitizing it. Teams hardening cross-frame messaging use details like this to catch the same gap before shipping."}},{"@type":"Question","name":"How was ChatGPT's Content Security Policy bypassed to run arbitrary JavaScript?","acceptedAnswer":{"@type":"Answer","text":"The CSP blocked inline JavaScript but allowed scripts from www.youtube.com. YouTube's oEmbed endpoint accepted a JSONP-style callback parameter and placed it into its response before validating it, so appending ';void' to the callback let the attacker's code run as a script loaded from an allowed origin, executing inside an unsandboxed srcdoc iframe with the chatgpt.com identity. Developers weighing which third-party script sources to allow in CSP can learn from this exact bypass."}}]} ```