We Took over ChatGPT Accounts

In October 2026, security researchers discovered a method to gain full control over an ordinary ChatGPT user's account. They managed to transform a regular public ChatGPT share into attacker-controlled JavaScript code running inside the authenticated session of the user who opened the shared link. By creating a malicious conversation and sharing the link, the attacker could execute the payload as if it were part of the victim's ChatGPT session, allowing them to access the victim's conversation list, retrieve data from private conversations, and send that data to an external server.

The vulnerability was not limited to just modifying the page or displaying an alert; it could even directly call ChatGPT's authenticated APIs on behalf of the victim, effectively taking over their account. The researchers found that this exploit stemmed from two seemingly harmless features: a graph and an HTML preview. The graph loaded a math library called MathLive, which installed a listener in the main ChatGPT page to handle messages related to the on-screen keyboard.

The preview sent two messages: one replaced a virtual keyboard layout with malicious HTML, and the second instructed MathLive to display the keyboard, rendering the new layout and allowing the attacker to inject arbitrary HTML into the victim's page through the keyboard's `innerHTML`. While the preview was initially contained within a separate website, the attacker found a way to bypass this isolation by convincing a trusted component in the main page to create a new, unsandboxed document for the malicious code.

This allowed the attacker to execute arbitrary JavaScript as if they were the victim, effectively taking control of their ChatGPT account. OpenAI addressed the issue shortly after the researchers reported it on October 26, classifying it as a critical priority (P1) due to the severity and potential impact of the exploit.